@chem-x/create-chemx@26.9.11-481
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe behavior is user-invoked and package-aligned, so it does not meet the install-hook malware boundary. However, unchecked server-controlled paths create a real unresolved remote file-write risk.
Static reason
No blocking static signals were detected.; source closely matched a different package identity
Trigger
The user runs the create or init CLI command and supplies or has a cached license key.
Impact
A compromised or malicious service response could place arbitrary files, including outside the intended scaffold directory.
Mechanism
Remote starter-kit download followed by unchecked file-path writes.
AI rationale
The behavior is user-invoked and package-aligned, so it does not meet the install-hook malware boundary. However, unchecked server-controlled paths create a real unresolved remote file-write risk.
Evidence
cli/license.jscli/scaffold.js~/.chemical-x/device_id~/.chemical-x/config.jsonselected project directory/**selected project directory/.cursorrules
Network endpoints1
chemicalx.xophz.com/api/starter-kit/download
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Explicit scaffold and init commands fetch a remote starter kit and write every returned path beneath the chosen target without path containment checks.
- The scaffold command creates a Cursor rules file in the selected new project.
- GitHub identity lookup only invokes local gh and git commands as part of the optional audit-sharing feature.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Remote fetching and project writes occur only after an explicit CLI create or init action.
- No secret harvesting, shell evaluation, self-dependency, or automatic exfiltration was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcecli/scaffold.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import fs from 'node:fs';
import path from 'node:path';
import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js';
import { obtainlicensekey, fetchstarterkitfiles, checkorpromptevaluation } from './license.js';
export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => {
renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)');
const licensekey = await obtainlicensekey(rawargs, onrunaudit);
if (!licensekey) {
process.stderr.write('\x1b[31m✕ valid license key is required to scaffold blueprints.\x1b[0m\n');
process.exit(1);
}
let targetname = projectname;
if (!targetname) {
targetname =
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
cli/scaffold.jsView on unpkg37for (const [relPath, content] of Object.entries(files)) {
const fullPath = path.join(targetDir, relPath);
const dirName = path.dirname(fullPath);
if (!fs.existsSync(dirName)) {
fs.mkdirSync(dirName, { recursive: true });
}
fs.writeFileSync(fullPath, content, 'utf-8');
process.stdout.write(` \x1b[32m✔\x1b[0m ${relPath}\n`);
}
Medium
Ai Review Evidence
Explicit scaffold and init commands fetch a remote starter kit and write every returned path beneath the chosen target without path containment checks.
cli/scaffold.jsFindings
2 High5 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js
HighPackage Source Clone Identity Mismatchcli/audit/social-git.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencecli/license.js
MediumAi Review Evidencecli/scaffold.js
MediumAi Review Evidencecli/scaffold.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @chem-x/create-chemx@26.9.11-481.
See all versions of @chem-x/create-chemx for other recorded verdicts.
- Review the evidence and your use of @chem-x/create-chemx@26.9.11-481 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.