registry / AI-agent control-surface risk / @chem-x/starter-kit / 26.9.17-309

@chem-x/starter-kit@26.9.17-309

Chemical X Protocol: Private drop-in architecture starter kit and capsule generator

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The package performs an unconsented install-time mutation of consumer AI-agent control surfaces and registers its own runnable MCP server. This meets the blocking policy for postinstall mutation of a foreign or broad agent control surface.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation of the package in a consumer project.

Impact

Consumer agent clients may load the newly registered package server, allowing its commands to participate in those clients' sessions.

Mechanism

The hook uses the install directory as its target and writes entries into project Cursor and VS Code MCP files, plus an existing global Antigravity MCP configuration. The entry can run the package's MCP command through npx when a local server is absent.

Policy narrative

During package installation, the postinstall hook automatically writes the package's MCP server configuration into consumer agent configuration files. This enables agent clients to launch the package's server, including through npx when no local server is available.

AI rationale

Evidence

package.jsoncli/postinstall.jscli/mcp/installer.js.cursor/mcp.json.vscode/mcp.json~/.gemini/config/mcp_config.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The package defines a postinstall hook that runs cli/postinstall.js.
The postinstall targets the consumer directory and automatically calls the MCP installer without a consent check.
The installer writes a Chemical X server entry into the consumer's Cursor and VS Code MCP configuration; it also updates an existing Antigravity configuration.
When no local server is found, the registered command invokes npx to fetch and run chemx mcp.

Evidence against

The installer preserves existing MCP server entries while adding its own entry.
The Antigravity write is conditional on an existing configuration directory.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 113 file(s), 629 KB of source, external domains: api.github.com, chemicalx.xophz.com, fallback.com, github.com, img.shields.io, mycompassconsulting.com, reports.chemicalx.xophz.com, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

Lines 35-74json

35 ".": "./cli/index.js",

36 "./audit": "./cli/audit.js",

37 "./build": "./cli/build.js",

38 "./search": "./cli/search.js",

39 "./mcp": "./cli/mcp/index.js",

40 "./reader": "./cli/reader.js",

41 "./patcher": "./cli/patcher.js"

42 },

43 "scripts": {

44 "publish:both": "node scripts/publish-both.mjs",

45 "test": "node --test cli/audit/*.spec.js cli/mcp/*.spec.js cli/*.spec.js",

46 "typecheck": "tsc --noEmit",

47 "create-capsule": "node cli/index.js",

48 "audit": "node cli/index.js audit",

49 "ci:audit": "node cli/index.js audit --ci --dir=cli",

50 "chemx": "node cli/index.js",

51 "q": "chemx search",

52 "search": "chemx search",

53 "mcp": "node cli/index.js mcp",

54 "install-mcp": "node cli/index.js install-mcp",

55 "postinstall": "node cli/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "read": "node cli/index.js read",

57 "patch": "node cli/index.js patch"

58 },

59 "dependencies": {

60 "@babel/parser": "^7.29.8",

61 "@babel/traverse": "^7.29.8",

62 "@babel/types": "^7.29.8",

63 "react": "^18.3.1",

64 "react-dom": "^18.3.1"

65 },

66 "devDependencies": {

67 "@types/babel__traverse": "^7.28.0",

68 "@types/node": "^22.20.2",

69 "@types/react": "^18.3.31",

70 "@types/react-dom": "^18.3.7",

71 "typescript": "^5.9.3"

72 }

73}

cli/audit-preflight-git.jsView file

1import fs from 'node:fs'; L2: import { spawnSync } from 'node:child_process'; L3:

High

Child Process

Package source references child process execution.

cli/audit-preflight-git.jsView on unpkg · L1

cli/terminal.jsView file

10} else if (platform === "win32") { L11: spawnSync("cmd.exe", ["/c", "start", '""', url], { stdio: "ignore", timeout: 3000 }); L12: } else {

High

Shell

Package source references shell execution.

cli/terminal.jsView on unpkg · L10

cli/license.jsView file

3import os from 'node:os'; L4: import { spawnSync } from 'node:child_process'; L5: import { ... L17: L18: export const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com'; L19: export const GATEKEEPER_API_URL = process.env.COMPASS_GATEKEEPER_URL || 'https://mycompassconsulting.com/wp-json/compass/v1/gatekeeper';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/license.jsView on unpkg · L3

•matchType = previous_version_dangerous_delta matchedPackage = @chem-x/starter-kit@26.9.14-1358 matchedIdentity = npm:QGNoZW0teC9zdGFydGVyLWtpdA:26.9.14-1358 similarity = 0.729 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/license.jsView on unpkg

cli/mcp/installer.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L17: export const mergeMcpServerConfig = (existingJsonString = '', serverDef = {}) => { L18: let parsed = { mcpServers: {} }; L19: ... L27: L28: const hasMcpServersObject = Boolean(parsed.mcpServers && typeof parsed.mcpServers === 'object'); L29: if (!hasMcpServersObject) { L30: parsed.mcpServers = {}; L31: } L32: L33: parsed.mcpServers[SERVER_KEY] = serverDef; L34: return JSON.stringify(parsed, null, 2) + '\n'; ... L87: const cursorDir = path.join(resolvedTarget, '.cursor'); Write operation from cli/mcp/installer.js: L17: export const mergeMcpServerConfig = (existingJsonString = '', serverDef = {}) => { L18: let parsed = { mcpServers: {} }; L19: ... L27: L28: const hasMcpServersObject = Boolean(parsed.mcpServers &

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/mcp/installer.jsView on unpkg · L1

cli/scaffold.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: udes('--no-interactive') || boolean(process.env.ci) || process.stdout?.istty === false || process.stdin?.istty === false || boolean(process.argv?.some((arg) => arg === '--headless' || arg === '--ci' || arg === '--yes' || arg === '-y')); if (isheadless) { targetname = 'my-molecular-app'; } else { targetname = hasgum() ? guminput('project directory name:', 'my-molecular-app') : await promptquestion('project directory name [my-molecular-app]: '); } } const finaldirname = targetname.trim() || 'my-molecular-app'; const targetdir = path.resolve(process.cwd(), finaldirname); const direxists = fs.existssync(targetdir); const isdirno

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/scaffold.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. s = {}; if (!licensekey) { process.stdout.write( '\n\x1b[38;2;98;201;255m⚡ chemical x: community edition (free)\x1b[0m\n' + 'the community version is free because you tell us about your project\n' + 'and the app will automatically post your scorecard to our github discussions.\n' + 'you get a free plug, we get data to prove chemical x works and brings real value.\n' + 'everybody wins! thank you for supporting our community version.\n\n' ); files = loadlocalblueprintfiles(); iscommunity = true; } else { files = await fetchstarterkitfiles(licensekey); } let targetname = projectname; if (!targetname) { const isheadle

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/pre-commit.shView file

•path = scripts/pre-commit.sh kind = build_helper sizeBytes = 5175 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pre-commit.shView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/audit-preflight-git.jsView file

1import fs from 'node:fs'; L2: import { spawnSync } from 'node:child_process'; L3:

High

Child Process

Package source references child process execution.

cli/audit-preflight-git.jsView on unpkg · L1

Findings

1 Critical7 High5 Medium4 Low

CriticalAi Agent Control Hijackcli/mcp/installer.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processcli/audit-preflight-git.js

HighShellcli/terminal.js

HighSame File Env Network Executioncli/license.js

HighExternal Ai Agent Control Surface Mutationcli/scaffold.js

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js

HighPrevious Version Dangerous Deltacli/license.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/pre-commit.sh

Affected versions and remediation

This report applies to @chem-x/starter-kit@26.9.17-309.

See all versions of @chem-x/starter-kit for other recorded verdicts.

Avoid installing @chem-x/starter-kit@26.9.17-309. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-12 05:55:40.543Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @chem-x

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

More from @chem-x

Other AI-agent control-surface risk packages

Source & flagged code