@chem-x/starter-kit@26.9.11-481
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has no install lifecycle hook, but its explicit scaffolder combines remote content installation, unvalidated paths, and AI-editor configuration writes. This is a real user-invoked capability risk rather than confirmed malware.
Static reason
No blocking static signals were detected.
Trigger
A user runs a create, scaffold, or init CLI command and supplies a license key.
Impact
A compromised or malicious configured endpoint could supply project content and unvalidated relative paths; the created rule file influences Cursor behavior.
Mechanism
Remote file-map installation and AI-editor rule creation.
AI rationale
The package has no install lifecycle hook, but its explicit scaffolder combines remote content installation, unvalidated paths, and AI-editor configuration writes. This is a real user-invoked capability risk rather than confirmed malware.
Evidence
cli/scaffold.jscli/license.js<chosen-project>/.cursorrules<chosen-project>/<server-supplied-relative-path>~/.chemical-x/config.json~/.chemical-x/device_id
Network endpoints1
chemicalx.xophz.com/api/starter-kit/download
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The user-invoked scaffolder downloads a server-provided file map and writes every supplied path without path validation.
- The scaffolder creates a .cursorrules file containing directives for an AI coding tool.
- The license endpoint can be overridden through an environment variable.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Network and project writes occur only after an explicit CLI scaffold or init command.
- No credential harvesting, silent exfiltration, obfuscation, or automatic persistence was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcecli/scaffold.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import fs from 'node:fs';
import path from 'node:path';
import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js';
import { obtainlicensekey, fetchstarterkitfiles, checkorpromptevaluation } from './license.js';
export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => {
renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)');
const licensekey = await obtainlicensekey(rawargs, onrunaudit);
if (!licensekey) {
process.stderr.write('\x1b[31m✕ valid license key is required to scaffold blueprints.\x1b[0m\n');
process.exit(1);
}
let targetname = projectname;
if (!targetname) {
targetname =
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
cli/scaffold.jsView on unpkg37for (const [relPath, content] of Object.entries(files)) {
const fullPath = path.join(targetDir, relPath);
const dirName = path.dirname(fullPath);
if (!fs.existsSync(dirName)) {
fs.mkdirSync(dirName, { recursive: true });
}
fs.writeFileSync(fullPath, content, 'utf-8');
process.stdout.write(` \x1b[32m✔\x1b[0m ${relPath}\n`);
}
Medium
Ai Review Evidence
The user-invoked scaffolder downloads a server-provided file map and writes every supplied path without path validation.
cli/scaffold.jsView on unpkg · L37Findings
1 High5 Medium5 Low
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencecli/scaffold.js
MediumAi Review Evidencecli/scaffold.js
MediumAi Review Evidencecli/license.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @chem-x/starter-kit@26.9.11-481.
See all versions of @chem-x/starter-kit for other recorded verdicts.
- Review the evidence and your use of @chem-x/starter-kit@26.9.11-481 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.