registry / @chemx/create-chemx / 26.10.8-344
@chemx/create-chemx@26.10.8-344
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe postinstall hook performs automatic first-party MCP configuration, creating a concrete agent-extension lifecycle risk. The inspected behavior supports a warning, but does not establish the broader control-surface abuse or other attack behavior required for a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; source closely matched a different package identity
Trigger
Installing the package with npm runs its postinstall hook.
Impact
Agent clients may load the package’s MCP gateway, whose single-tool interface reduces per-operation approval boundaries; mutating calls have project-root checks.
Mechanism
The hook adds MCP server entries to project-local Cursor and VS Code settings and, when present, global Antigravity settings.
AI rationale
The postinstall hook performs automatic first-party MCP configuration, creating a concrete agent-extension lifecycle risk. The inspected behavior supports a warning, but does not establish the broader control-surface abuse or other attack behavior required for a block.
Evidence
package.jsoncli/postinstall.jscli/mcp/installer.jscli/mcp/antigravity.jscli/mcp/call-scope.js.cursor/mcp.json.vscode/mcp.json~/.gemini/config/mcp_config.json~/.gemini/antigravity/mcp/chemical-x/
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs cli/postinstall.js after installation, and that script automatically invokes the MCP installer for the consumer directory.
- The installer writes the Chemical X MCP registration to project-local Cursor and VS Code configuration.
- When the Antigravity configuration directory exists, the installer also updates its global MCP configuration and synchronizes agent schemas and instructions.
- The setup guide says the single gateway avoids separate approval for each MCP sub-operation.
- Mutating MCP calls have project-root checks, limiting the confirmed risk to automatic first-party agent integration setup.
Evidence against
- The inspected setup registers the package’s own MCP server; it does not establish credential collection, data exfiltration, or remote payload execution.
- Antigravity configuration is conditional on an existing configuration directory, and mutating calls are subject to project-root checks.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
Source & flagged code
16 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node cli/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node cli/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli/audit-preflight-git.jsView file
1import fs from 'node:fs';
L2: import { spawnSync } from 'node:child_process';
L3:
High
Child Process
Package source references child process execution.
cli/audit-preflight-git.jsView on unpkg · L1Findings
1 Critical13 High5 Medium5 Low
CriticalAi Agent Control Hijackcli/mcp/installer.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processcli/audit-preflight-git.js
HighShellcli/build/executor.js
HighSame File Env Network Executioncli/license.js
HighSemantic Analysis Limitedcli/audit/ai-slop-detector.js#virtual:normalized:round1
HighKnown Malware Source Similaritycli/audit/social-git.js
HighKnown Malware Source Similaritycli/license.js
HighKnown Malware Source Similaritycli/build/executor.js
HighKnown Malware Source Similaritycli/errors/publisher.js
HighKnown Malware Source Similaritycli/navigator-share.js
Affected versions and remediation
This report applies to @chemx/create-chemx@26.10.8-344.
See all versions of @chemx/create-chemx for other recorded verdicts.
- Review the evidence and your use of @chemx/create-chemx@26.10.8-344 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.