@chemx/create-chemx@26.9.12-1140
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package is not an automatic install-time threat, but its remote, unvalidated file delivery creates a real supply-chain write primitive. Treat it as suspicious until returned paths are contained and downloaded content is authenticated.
Static reason
No blocking static signals were detected.; source closely matched a different package identity; previous stored version diff introduced dangerous source
Trigger
The user runs create-chemx, chemx create, or chemx init and provides a license key.
Impact
A compromised or malicious service response can place files outside the intended project through traversal paths and can deliver executable project content for later use.
Mechanism
Remote file-map download followed by unrestricted project writes.
AI rationale
The package is not an automatic install-time threat, but its remote, unvalidated file delivery creates a real supply-chain write primitive. Treat it as suspicious until returned paths are contained and downloaded content is authenticated.
Evidence
cli/license.jscli/scaffold.js~/.chemical-x/device_id~/.chemical-x/config.json<targetDir>/<remote relPath><targetDir>/.cursorrules
Network endpoints1
chemicalx.xophz.com/api/starter-kit/download
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- The create and init commands write every filename and content value returned by the remote service without validating that paths stay inside the selected project.
- The remote request sends the supplied license key and a persistent device identifier to the Chemical X service.
- A scaffold run also creates a Cursor rules file that directs AI-agent behavior in the generated project.
Evidence against
- package.json has no preinstall, install, postinstall, or other automatic lifecycle hook.
- The network download and project writes occur only after the user invokes a create or init command and provides a license key.
- No source evidence shows secret harvesting beyond the supplied license key, arbitrary shell execution, or automatic exfiltration.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcecli/navigator-share.jsView file
2import path from 'node:path';
L3: import { spawnSync } from 'node:child_process';
L4: import {
High
Child Process
Package source references child process execution.
cli/navigator-share.jsView on unpkg · L2cli/terminal.jsView file
10} else if (platform === "win32") {
L11: spawnSync("cmd.exe", ["/c", "start", '""', url], { stdio: "ignore" });
L12: } else {
High
cli/license.jsView file
3import os from 'node:os';
L4: import { spawnSync } from 'node:child_process';
L5: import {
...
L17:
L18: export const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com';
L19: export const URL_LEARN = 'https://chemicalx.xophz.com';
Findings
6 High2 Medium5 Low
HighChild Processcli/navigator-share.js
HighShellcli/terminal.js
HighSame File Env Network Executioncli/license.js
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js
HighPackage Source Clone Identity Mismatchcli/audit/social-git.js
HighPrevious Version Dangerous Deltacli/license.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @chemx/create-chemx@26.9.12-1140.
See all versions of @chemx/create-chemx for other recorded verdicts.
- Review the evidence and your use of @chemx/create-chemx@26.9.12-1140 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.