registry / @chem-x/create-chemx / 26.9.13-272
@chem-x/create-chemx@26.9.13-272
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest exposes CLI entrypoints without install lifecycle hooks, and the flagged source paths show interactive project scaffolding, service license verification, terminal helpers, and build execution. The inspected code establishes no concrete attack behavior.
Static reason
No blocking static signals were detected.; source closely matched a different package identity; previous stored version diff introduced dangerous source
Trigger
A user invokes the CLI and selects a command such as scaffolding, sharing an audit, or running a build audit.
Impact
These inspected behaviors support the package's CLI functions; no concrete malicious action was established.
Mechanism
The CLI requests a license from its configured service, writes downloaded starter files into the selected project, and uses terminal or process helpers for user-requested tasks.
AI rationale
The manifest exposes CLI entrypoints without install lifecycle hooks, and the flagged source paths show interactive project scaffolding, service license verification, terminal helpers, and build execution. The inspected code establishes no concrete attack behavior.
Evidence
package.jsoncli/navigator-share.jscli/terminal.jscli/license.jscli/scaffold.jscli/audit/social-git.jscli/build/executor.js
Network endpoints1
chemicalx.xophz.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes a user-run CLI and defines no lifecycle hooks.
- Scaffolding runs through explicit CLI actions and writes starter files into the selected project directory.
- The license request sends a supplied license key and generated device identifier to the configured service.
- The flagged process execution supports browser opening, interactive terminal tools, and caller-supplied build commands.
- Git repository metadata is read to derive project information; no attack behavior was established in the inspected code.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcecli/navigator-share.jsView file
2import path from 'node:path';
L3: import { spawnSync } from 'node:child_process';
L4: import {
High
Child Process
Package source references child process execution.
cli/navigator-share.jsView on unpkg · L2cli/terminal.jsView file
10} else if (platform === "win32") {
L11: spawnSync("cmd.exe", ["/c", "start", '""', url], { stdio: "ignore" });
L12: } else {
High
cli/license.jsView file
3import os from 'node:os';
L4: import { spawnSync } from 'node:child_process';
L5: import {
...
L17:
L18: export const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com';
L19: export const URL_LEARN = 'https://chemicalx.xophz.com';
Findings
6 High2 Medium5 Low
HighChild Processcli/navigator-share.js
HighShellcli/terminal.js
HighSame File Env Network Executioncli/license.js
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js
HighPackage Source Clone Identity Mismatchcli/audit/social-git.js
HighPrevious Version Dangerous Deltacli/build/executor.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @chem-x/create-chemx@26.9.13-272.
See all versions of @chem-x/create-chemx for other recorded verdicts.
- Review the evidence and your use of @chem-x/create-chemx@26.9.13-272 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.