registry / AI-agent capability abuse / @chem-x/create-chemx / 26.9.11-362

@chem-x/create-chemx@26.9.11-362

Chemical X Protocol: Private drop-in architecture starter kit and capsule generator

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No automatic npm lifecycle execution or self-dependency chain exists. The explicit scaffolding flow nevertheless writes an AI-agent control file and remote vendor-provided content into consumer projects, so it warrants a warning.

Static reason

No blocking static signals were detected.; source closely matched a different package identity

Trigger

Running create, init, or hook commands

Impact

Remote scaffold content and package-defined AI instructions can affect the created project; no automatic install-time execution was found.

Mechanism

User-triggered project scaffolding and guardrail installation

AI rationale

Evidence

cli/scaffold.jscli/license.jscli/installer.js.cursorrules.git/hooks/pre-commit.github/workflows/chemx-audit.yml.chemx/config.json

Network endpoints1

chemicalx.xophz.com/api/starter-kit/download

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The create command writes a .cursorrules file into the newly created project, directing AI agents to follow package-defined rules.
The scaffold fetches a license-verified file map from chemicalx.xophz.com and writes its returned contents into the target project.
The hook setup command can write a Git pre-commit hook and a GitHub Actions workflow after an interactive user choice.

Evidence against

package.json has no preinstall, install, postinstall, or other automatic lifecycle hook.
The AI-rule write occurs only through the user-invoked scaffold command and is limited to its target directory.
GitHub publishing uses a token only when the user requests audit sharing.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

Source & flagged code

5 flagged

cli/scaffold.jsView file

Lines 27-67javascript

27 if (isDirNonEmpty) {

28 process.stderr.write(`\x1b[31m✕ Error: Directory '${finalDirName}' already exists and is not empty.\x1b[0m\n`);

29 process.exit(1);

30 }

32 const files = await fetchStarterKitFiles(licenseKey);

34 process.stdout.write(`Scaffolding Molecular Architecture into: \x1b[36m${finalDirName}/\x1b[0m\n`);

35 fs.mkdirSync(targetDir, { recursive: true });

37 for (const [relPath, content] of Object.entries(files)) {

38 const fullPath = path.join(targetDir, relPath);

39 const dirName = path.dirname(fullPath);

40 if (!fs.existsSync(dirName)) {

41 fs.mkdirSync(dirName, { recursive: true });

42 }

43 fs.writeFileSync(fullPath, content, 'utf-8');

44 process.stdout.write(` \x1b[32m✔\x1b[0m ${relPath}\n`);

45 }

47 const cursorRulesPath = path.join(targetDir, '.cursorrules');

48 if (!fs.existsSync(cursorRulesPath)) {

49 const rules = '# Chemical X Molecular Architecture Directives\nStrictly follow AGENTS.md rules. Never exceed 500 lines per file. All molecule capsules must stay under 100 lines.\n';

50 fs.writeFileSync(cursorRulesPath, rules, 'utf-8');

Medium

Ai Review Evidence

The create command writes a .cursorrules file into the newly created project, directing AI agents to follow package-defined rules.

cli/scaffold.jsView on unpkg · L47

51 process.stdout.write(' \x1b[32m✔\x1b[0m .cursorrules\n');

52 }

54 process.stdout.write(

55 `\n\x1b[1m\x1b[32m✔ Molecular Architecture project created successfully at ${finalDirName}!\x1b[0m\n\n`

56 );

57 process.stdout.write('Next Steps:\n');

58 process.stdout.write(` 1. cd ${finalDirName}\n`);

59 process.stdout.write(' 2. Review AGENTS.md for line budgets and architecture standards\n');

60 process.stdout.write(' 3. Run npx chemx generate m-<feature> to create capsules\n');

61 process.stdout.write(' 4. Run npx chemx audit to scan for line budget compliance\n\n');

62};

64export const runInit = async (targetSubDir = 'src/chemical-x', rawArgs = [], onRunAudit = null) => {

65 renderBanner('Chemical X: In-Repo Capsule Drop-in');

67 const targetDir = path.resolve(process.cwd(), targetSubDir);

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js'; import { obtainlicensekey, fetchstarterkitfiles, checkorpromptevaluation } from './license.js'; export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => { renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)'); const licensekey = await obtainlicensekey(rawargs, onrunaudit); if (!licensekey) { process.stderr.write('\x1b[31m✕ valid license key is required to scaffold blueprints.\x1b[0m\n'); process.exit(1); } let targetname = projectname; if (!targetname) { targetname =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/scaffold.jsView on unpkg

cli/audit/social-git.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = create-chemx@26.9.11-362 matchedPath = cli/audit.js matchedIdentity = npm:Y3JlYXRlLWNoZW14:26.9.11-362 similarity = 1.000 shingleOverlap = 31 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

cli/audit/social-git.jsView on unpkg

cli/license.jsView file

285export const fetchStarterKitFiles = async (licenseKey) => { const normalizedKey = licenseKey.trim().toUpperCase(); const deviceId = getOrCreateDeviceId(); process.stdout.write(`\nVerifying license via edge: ${API_BASE}...\n`); try { const res = await fetch(`${API_BASE}/api/starter-kit/download`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ licenseKey: normalizedKey, deviceId })

Medium

Ai Review Evidence

The scaffold fetches a license-verified file map from chemicalx.xophz.com and writes its returned contents into the target project.

cli/license.jsView on unpkg · L285

cli/installer.jsView file

33export const runInstallWizard = async (targetDir = '.') => { const isGit = fs.existsSync(path.resolve(targetDir, '.git')); process.stdout.write('\n\x1b[1m\x1b[38;2;98;201;255mChemical X: Architecture Guardrail Installer\x1b[0m\n\n'); const targetChoice = hasGum() ? gumChoose(['1. Install All Guardrails (Git Pre-Commit Hook + GitHub CI Workflow)', '2. Git Pre-Commit Hook only (.git/hooks/pre-commit)', '3. GitHub Actions CI Workflow only (.github/workflows/chemx-audit.yml)', '4. Cancel']) : await promptQuestion('Select target: [1] All, [2] Hook, [3] CI, [4] Cancel (default: 1): ');

Medium

Ai Review Evidence

The hook setup command can write a Git pre-commit hook and a GitHub Actions workflow after an interactive user choice.

cli/installer.jsView on unpkg · L33

Source & flagged code

5 flagged · loading source

cli/scaffold.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/scaffold.jsView on unpkg

47const cursorRulesPath = path.join(targetDir, '.cursorrules'); if (!fs.existsSync(cursorRulesPath)) { const rules = '# Chemical X Molecular Architecture Directives\nStrictly follow AGENTS.md rules. Never exceed 500 lines per file. All molecule capsules must stay under 100 lines.\n'; fs.writeFileSync(cursorRulesPath, rules, 'utf-8');

Medium

Ai Review Evidence

The create command writes a .cursorrules file into the newly created project, directing AI agents to follow package-defined rules.

cli/scaffold.jsView on unpkg · L47

Findings

2 High5 Medium5 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js

HighPackage Source Clone Identity Mismatchcli/audit/social-git.js

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidencecli/scaffold.js

MediumAi Review Evidencecli/license.js

MediumAi Review Evidencecli/installer.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @chem-x/create-chemx@26.9.11-362.

See all versions of @chem-x/create-chemx for other recorded verdicts.

Review the evidence and your use of @chem-x/create-chemx@26.9.11-362 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 06:29:05.438Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @chem-x

Behavioral surface

Related packages

More from @chem-x

Source & flagged code