npm scope
@chemx
LPM Firewall blocks 2 packages in the @chemx npm scope. 2 have LPM's own review and are listed first.
Oct 12, 2026
@chemx/create-chemx@26.10.7-1061
AI-agent control-surface riskThe automatic postinstall mutates foreign AI-agent control configuration without consent. This meets the policy for blocking an unconsented install-time control-surface mutation.
Oct 12, 2026
@chemx/starter-kit@26.10.7-1061
AI-agent control-surface riskThe automatic postinstall mutates foreign AI-agent configuration and registers an executable MCP server without a consent guard. This is an unconsented install-time control-surface change...
Each card opens the package page with its evidence and every recorded version.