@chem-x/starter-kit@26.9.20-1257
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe active postinstall path performs unconsented writes to consumer AI-agent configuration and registers a tool with broad project capabilities. This meets the policy for blocking install-time AI-agent control-surface mutation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package through npm runs its postinstall hook in the consumer project.
Impact
Agent hosts gain a newly registered tool with project read, write, patch, and other operations, without an explicit setup prompt during installation.
Mechanism
The hook invokes the MCP installer, which writes Cursor and VS Code project configuration and may modify global Antigravity configuration to launch the package server.
Policy narrative
The manifest runs cli/postinstall.js during installation. That script calls installAllMcpConfigs for the consumer project, which registers a Chemical X MCP server in agent configuration and may also update global Antigravity settings. The exposed gateway includes project-changing operations. No install-time consent gate was found in this path.
AI rationale
The active postinstall path performs unconsented writes to consumer AI-agent configuration and registers a tool with broad project capabilities. This meets the policy for blocking install-time AI-agent control-surface mutation.
Evidence
package.jsoncli/postinstall.jscli/mcp/installer.jscli/mcp/manifests.js.cursor/mcp.json.vscode/mcp.json~/.gemini/config/mcp_config.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 95.0% confidence with low false-positive risk.
Evidence for policy risk
- The package postinstall hook runs a script that targets the consumer project and calls the MCP installer without a consent prompt.
- The installer writes MCP server configuration into consumer Cursor and VS Code settings, and also updates Antigravity configuration when present.
- The registered tool is described as an exclusive gateway and exposes operations including write and patch.
- The other inspected configuration targets are installer or test locations; they do not establish consent for the postinstall changes.
- The setup wizard writes project agent guidance, and the installer contains directives that steer agent behavior.
Evidence against
- The postinstall skips when run inside the starter-kit itself; that guard does not prevent consumer-project mutation.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node cli/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node cli/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli/errors/errors.spec.jsView file
27patternName = github_pat
severity = critical
line = 27
Critical
Critical Secret
Package contains a critical-looking secret pattern.
cli/errors/errors.spec.jsView on unpkg · L27Findings
3 Critical5 High5 Medium4 Low
CriticalCritical Secretcli/errors/errors.spec.js
CriticalAi Agent Control Hijackcli/mcp/installer.js
CriticalSecret Patterncli/errors/errors.spec.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processcli/audit-preflight-git.js
HighShellcli/build/executor.js
HighSame File Env Network Executioncli/license.js
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/pillars-wizard.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/pre-commit.sh
Affected versions and remediation
This report applies to @chem-x/starter-kit@26.9.20-1257.
See all versions of @chem-x/starter-kit for other recorded verdicts.
- Avoid installing @chem-x/starter-kit@26.9.20-1257. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.