@chemx/create-chemx@26.9.23-1269
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe package's automatic postinstall writes MCP server configuration into consumer AI-agent settings without a separate consent step. This meets the install-time AI-agent control-surface mutation block policy, although the inspected behavior does not establish credential theft or a remote payload.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package through npm, which runs its postinstall hook.
Impact
A later agent session can discover and launch the registered ChemX MCP server; the package changes agent configuration without a separate user setup action.
Mechanism
The hook calls the MCP installer for the consumer directory; it writes Cursor and VS Code MCP configuration and may update an existing Antigravity configuration.
Policy narrative
During npm installation, the postinstall hook registers the package's MCP server in project-level Cursor and VS Code settings, and in an existing Antigravity configuration. This changes AI-agent control configuration without a separate setup action. The inspected fallback launches `chemx mcp` through npm exec; the cited behavior does not establish a remote endpoint or credential theft.
AI rationale
The package's automatic postinstall writes MCP server configuration into consumer AI-agent settings without a separate consent step. This meets the install-time AI-agent control-surface mutation block policy, although the inspected behavior does not establish credential theft or a remote payload.
Evidence
package.jsoncli/postinstall.jscli/mcp/installer.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs cli/postinstall.js automatically after installation.
- The postinstall targets the consumer project and calls installAllMcpConfigs without a consent check.
- That call writes MCP server configurations into project-level Cursor and VS Code settings, and can also update an existing Antigravity user configuration.
- The generated fallback server command invokes npm exec -y -- chemx mcp.
- Other inspected agent integration locations concern explicit setup or tests; they do not remove the postinstall behavior.
Evidence against
- The installer registers the package's MCP server rather than an identified third-party remote endpoint.
- Antigravity configuration is only changed when its configuration directory already exists.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node cli/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node cli/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli/errors/errors.spec.jsView file
27patternName = github_pat
severity = critical
line = 27
Critical
Critical Secret
Package contains a critical-looking secret pattern.
cli/errors/errors.spec.jsView on unpkg · L27Findings
3 Critical5 High5 Medium5 Low
CriticalCritical Secretcli/errors/errors.spec.js
CriticalAi Agent Control Hijackcli/mcp/installer.js
CriticalSecret Patterncli/errors/errors.spec.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processcli/audit-preflight-git.js
HighShellcli/build/executor.js
HighSame File Env Network Executioncli/license.js
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/pillars-wizard.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/pre-commit.sh
Affected versions and remediation
This report applies to @chemx/create-chemx@26.9.23-1269.
See all versions of @chemx/create-chemx for other recorded verdicts.
- Avoid installing @chemx/create-chemx@26.9.23-1269. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.