registry / AI-agent capability abuse / @chemx/create-chemx / 26.9.16-41

@chemx/create-chemx@26.9.16-41

Chemical X Protocol: Private drop-in architecture starter kit and capsule generator

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The package has an explicit, user-selected installer path that modifies agent-facing project configuration, so a warning is appropriate. The declared postinstall target was absent from the package file listing, and the inspected source did not establish an active install-time attack.

Static reason

One or more suspicious static signals were detected.; source closely matched a different package identity

Trigger

A user invokes the CLI installer and selects a setup option that includes query-machine or MCP configuration.

Impact

Agent behavior and project MCP settings may change after the user selects setup.

Mechanism

The installer appends a search directive to an existing `AGENTS.md` and writes MCP configuration files in project directories.

AI rationale

Evidence

cli/installer.jscli/mcp/installer.js

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The `install` command enters a wizard that offers agent query setup and MCP configuration.
The installer can append a search directive to an existing project `AGENTS.md`.
MCP setup writes server configuration into project `.cursor/mcp.json` and `.vscode/mcp.json`.
The package declares a postinstall command, but the referenced `scripts/postinstall.mjs` is absent from the package file listing.

Evidence against

The agent configuration changes are reached through the explicit CLI installer wizard, which offers distinct setup choices.
Project scaffolding writes `.cursorrules` only while creating a project, and the share flow is an explicit audit feature.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 85 file(s), 576 KB of source, external domains: api.github.com, chemicalx.xophz.com, github.com, img.shields.io, mycompassconsulting.com, www.w3.org

Source & flagged code

7 flagged

package.jsonView file

Lines 30-69json

30 ".": "./cli/index.js",

31 "./audit": "./cli/audit.js",

32 "./build": "./cli/build.js",

33 "./search": "./cli/search.js",

34 "./mcp": "./cli/mcp/index.js",

35 "./reader": "./cli/reader.js",

36 "./patcher": "./cli/patcher.js"

37 },

38 "scripts": {

39 "publish:both": "node scripts/publish-both.mjs",

40 "test": "node --test cli/audit/*.spec.js cli/mcp/*.spec.js cli/*.spec.js",

41 "typecheck": "tsc --noEmit",

42 "create-capsule": "node cli/index.js",

43 "audit": "node cli/index.js audit",

44 "ci:audit": "node cli/index.js audit --ci --dir=cli",

45 "chemx": "node cli/index.js",

46 "q": "node cli/index.js q",

47 "search": "node cli/index.js search",

48 "mcp": "node cli/index.js mcp",

49 "install-mcp": "node cli/index.js install-mcp",

50 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "read": "node cli/index.js read",

52 "patch": "node cli/index.js patch"

53 },

54 "dependencies": {

55 "@babel/parser": "^7.29.8",

56 "@babel/traverse": "^7.29.8",

57 "@babel/types": "^7.29.8",

58 "react": "^18.3.1",

59 "react-dom": "^18.3.1"

60 },

61 "devDependencies": {

62 "@types/babel__traverse": "^7.28.0",

63 "@types/node": "^22.20.2",

64 "@types/react": "^18.3.31",

65 "@types/react-dom": "^18.3.7",

66 "typescript": "^5.9.3"

67 }

68}

cli/navigator-share.jsView file

Lines 1-22javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import { spawnSync } from 'node:child_process';

4import {

High

Child Process

Package source references child process execution.

cli/navigator-share.js

cli/terminal.jsView file

Lines 1-30javascript

1import readline from "node:readline";

2import { spawnSync } from "node:child_process";

3import { formatChemicalXGradient, ANSI } from "./theme.js";

5export const openBrowser

cli/license.jsView file

Lines 1-23javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import os from 'node:os';

4import { spawnSync } from 'node:child_process';

cli/scaffold.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js'; import { obtainlicensekey, fetchstarterkitfiles, loadlocalblueprintfiles } from './license.js'; export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => { renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)'); const licensekey = await obtainlicensekey(rawargs, onrunaudit); let iscommunity = false; let files = {}; if (!licensekey) { process.stdout.write( '\n\x1b[38;2;98;201;255m⚡ chemical x: community edition (free)\x1b[0m\n' + 'the community version is free because

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/scaffold.jsView on unpkg

cli/audit/social-git.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = create-chemx@26.9.14-1358 matchedPath = cli/audit.js matchedIdentity = npm:Y3JlYXRlLWNoZW14:26.9.14-1358 similarity = 0.757 shingleOverlap = 53 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

cli/audit/social-git.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/navigator-share.jsView file

2import path from 'node:path'; L3: import { spawnSync } from 'node:child_process'; L4: import {

High

Child Process

Package source references child process execution.

cli/navigator-share.jsView on unpkg · L2

Findings

6 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processcli/navigator-share.js

HighShellcli/terminal.js

HighSame File Env Network Executioncli/license.js

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js

HighPackage Source Clone Identity Mismatchcli/audit/social-git.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @chemx/create-chemx@26.9.16-41.

See all versions of @chemx/create-chemx for other recorded verdicts.

Review the evidence and your use of @chemx/create-chemx@26.9.16-41 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 06:42:38.560Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @chemx

Behavioral surface

Related packages

More from @chemx

Source & flagged code