@chem-x/starter-kit@26.9.11-362
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package does not execute automatically on npm install, but its explicit scaffold path is an unchecked remote payload carrier with a project/agent configuration write. Static source does not establish that the vendor endpoint currently delivers malicious content.
Static reason
No blocking static signals were detected.
Trigger
Running the create or init CLI command with a license key.
Impact
A compromised or hostile configured service could place arbitrary files outside the intended project, including agent configuration.
Mechanism
Remote file delivery followed by unchecked local writes.
AI rationale
The package does not execute automatically on npm install, but its explicit scaffold path is an unchecked remote payload carrier with a project/agent configuration write. Static source does not establish that the vendor endpoint currently delivers malicious content.
Evidence
cli/license.jscli/scaffold.js<targetDir>/<server-provided relPath><targetDir>/.cursorrules
Network endpoints1
chemicalx.xophz.com/api/starter-kit/download
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The scaffold fetches a server-provided file set and writes every returned path and content without path validation.
- The create command adds a Cursor rules file that directs an AI agent in the new project.
- The package has no npm install lifecycle hook; these actions require an explicit CLI command.
Evidence against
- No preinstall, install, or postinstall script is declared.
- The GitHub token is used only by the explicit audit-sharing flow.
- No secret harvesting, destructive deletion, or hidden shell execution was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcecli/scaffold.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import fs from 'node:fs';
import path from 'node:path';
import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js';
import { obtainlicensekey, fetchstarterkitfiles, checkorpromptevaluation } from './license.js';
export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => {
renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)');
const licensekey = await obtainlicensekey(rawargs, onrunaudit);
if (!licensekey) {
process.stderr.write('\x1b[31m✕ valid license key is required to scaffold blueprints.\x1b[0m\n');
process.exit(1);
}
let targetname = projectname;
if (!targetname) {
targetname =
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
cli/scaffold.jsView on unpkg37for (const [relPath, content] of Object.entries(files)) {
const fullPath = path.join(targetDir, relPath);
const dirName = path.dirname(fullPath);
if (!fs.existsSync(dirName)) {
fs.mkdirSync(dirName, { recursive: true });
}
fs.writeFileSync(fullPath, content, 'utf-8');
process.stdout.write(` \x1b[32m✔\x1b[0m ${relPath}\n`);
}
Medium
Ai Review Evidence
The scaffold fetches a server-provided file set and writes every returned path and content without path validation.
cli/scaffold.jsView on unpkg · L37Findings
1 High5 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencecli/scaffold.js
MediumAi Review Evidencecli/license.js
MediumAi Review Evidencecli/scaffold.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @chem-x/starter-kit@26.9.11-362.
See all versions of @chem-x/starter-kit for other recorded verdicts.
- Review the evidence and your use of @chem-x/starter-kit@26.9.11-362 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.