@chem-x/create-chemx@26.9.11-631
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThere is no lifecycle execution, self-dependency, stealth persistence, or confirmed exfiltration. The package has an explicit-user-command remote deployment path and AI-agent configuration mutation, so it should be warned rather than marked clean.
Static reason
No blocking static signals were detected.; source closely matched a different package identity; previous stored version diff introduced dangerous source
Trigger
A user runs the scaffold/init command or invokes audit sharing.
Impact
A compromised service could supply unexpected project files; the CLI also adds scoped AI instructions during project creation.
Mechanism
Remote starter-file deployment and opt-in GitHub Discussion publishing.
AI rationale
There is no lifecycle execution, self-dependency, stealth persistence, or confirmed exfiltration. The package has an explicit-user-command remote deployment path and AI-agent configuration mutation, so it should be warned rather than marked clean.
Evidence
cli/license.jscli/scaffold.jscli/audit/social-publisher.js.chemical-x/config.json.chemical-x/device_id.cursorrules<selected project directory>/<server-provided path>
Network endpoints2
chemicalx.xophz.com/api/starter-kit/downloadapi.github.com/graphql
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The explicit scaffold/init commands send a supplied license key and device ID to a remote service, then accept a server-provided file map.
- Server-provided paths and contents are written into the selected project directory without path validation.
- The explicit scaffold command creates a .cursorrules AI-agent instruction file when absent.
- The explicit audit sharing flow can use an existing GitHub token to publish project audit content to GitHub Discussions.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- Network and write behavior is reachable only through user-invoked CLI commands, not package installation.
- Child-process calls use fixed utility commands and GitHub CLI operations; no eval or dynamic code execution was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcecli/navigator-share.jsView file
2import path from 'node:path';
L3: import { spawnSync } from 'node:child_process';
L4: import {
High
Child Process
Package source references child process execution.
cli/navigator-share.jsView on unpkg · L2cli/terminal.jsView file
9} else if (platform === "win32") {
L10: spawnSync("cmd.exe", ["/c", "start", '""', url], { stdio: "ignore" });
L11: } else {
High
cli/license.jsView file
3import os from 'node:os';
L4: import { spawnSync } from 'node:child_process';
L5: import {
...
L16:
L17: export const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com';
L18: export const URL_LEARN = 'https://chemicalx.xophz.com';
Findings
6 High2 Medium5 Low
HighChild Processcli/navigator-share.js
HighShellcli/terminal.js
HighSame File Env Network Executioncli/license.js
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js
HighPackage Source Clone Identity Mismatchcli/audit/social-git.js
HighPrevious Version Dangerous Deltacli/license.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @chem-x/create-chemx@26.9.11-631.
See all versions of @chem-x/create-chemx for other recorded verdicts.
- Review the evidence and your use of @chem-x/create-chemx@26.9.11-631 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.