@chem-x/create-chemx@26.9.28-1234
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest activates an automatic postinstall that installs an MCP server into consumer and, when present, global agent configurations without a consent guard. This meets the policy for blocking unconsented install-time mutation of an AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package through npm, which runs its postinstall hook.
Impact
AI-agent clients may launch the added server and expose its tools in the consumer's environment.
Mechanism
The hook calls the MCP installer, which writes project-level Cursor and VS Code configuration and, if present, the user's global Antigravity configuration. The entry runs the local CLI or resolves the chemx command through npm exec.
Policy narrative
On npm installation, the postinstall hook writes a package-owned MCP server entry into consumer AI-agent configuration without asking first. The configured server may be resolved through npm exec when a local CLI is unavailable. This is an unconsented install-time mutation of AI-agent control configuration.
AI rationale
The manifest activates an automatic postinstall that installs an MCP server into consumer and, when present, global agent configurations without a consent guard. This meets the policy for blocking unconsented install-time mutation of an AI-agent control surface.
Evidence
package.jsoncli/postinstall.jscli/mcp/installer.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- The package runs cli/postinstall.js during installation, and that script automatically calls the MCP installer for the consumer directory.
- The MCP installer writes a Chemical X server entry to project Cursor and VS Code configurations and, when an Antigravity configuration directory exists, to the user's global configuration.
- If no local server entrypoint is found, the configuration launches `npm exec -y -- chemx mcp`; the package does not check for user consent before writing these configurations.
- The installer and wizard agent-configuration locations were inspected; the wizard writes AGENTS.md and .cursorrules only through its separate setup path.
Evidence against
- The postinstall code skips when the consumer directory is the package's own directory.
- The MCP installer preserves other configured servers while setting its own named entry.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node cli/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node cli/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli/errors/errors.spec.jsView file
27patternName = github_pat
severity = critical
line = 27
Critical
Critical Secret
Package contains a critical-looking secret pattern.
cli/errors/errors.spec.jsView on unpkg · L27Findings
3 Critical6 High5 Medium5 Low
CriticalCritical Secretcli/errors/errors.spec.js
CriticalAi Agent Control Hijackcli/mcp/installer.js
CriticalSecret Patterncli/errors/errors.spec.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processcli/audit-preflight-git.js
HighShellcli/build/executor.js
HighSame File Env Network Executioncli/license.js
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/pillars-wizard.js
HighSemantic Analysis Limitedcli/verify-lint.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
Medium
Affected versions and remediation
This report applies to @chem-x/create-chemx@26.9.28-1234.
See all versions of @chem-x/create-chemx for other recorded verdicts.
- Avoid installing @chem-x/create-chemx@26.9.28-1234. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.