@chemx/create-chemx@26.9.25-1337
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe active postinstall hook makes unconsented changes to consumer and potentially user-level AI-agent configuration. This meets the blocking policy for install-time mutation of agent control surfaces.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package through npm, which runs its postinstall hook.
Impact
The consumer project and, when present, user-level agent configuration are altered so supported agents can invoke the package MCP server.
Mechanism
The hook passes the consumer install directory to an installer that writes Cursor and VS Code MCP configuration and conditionally writes Antigravity configuration, without requesting consent.
Policy narrative
The package’s npm postinstall hook automatically registers its MCP server in consumer agent configuration. The writes affect project-level Cursor and VS Code files and can also affect a user-level Antigravity file. The inspected lifecycle path contains no consent check, so this is an unconsented install-time mutation of AI-agent control surfaces.
AI rationale
The active postinstall hook makes unconsented changes to consumer and potentially user-level AI-agent configuration. This meets the blocking policy for install-time mutation of agent control surfaces.
Evidence
package.jsoncli/postinstall.jscli/mcp/installer.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The package’s postinstall script runs cli/postinstall.js during installation.
- The lifecycle handler targets the consumer directory and calls installAllMcpConfigs without a consent check.
- That installer adds the package’s MCP server to the consumer’s Cursor and VS Code configuration and conditionally to the user’s Antigravity configuration.
- The installer test confirms these project configuration changes occur when installProjectMcpConfig runs.
- The pillars wizard writes agent steering files only through a separate interactive installer choice.
Evidence against
- The MCP server configuration points to this package’s local CLI when available, or invokes the package-aligned chemx command.
- The inspected sources do not establish credential theft or a separate malicious payload.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node cli/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node cli/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli/errors/errors.spec.jsView file
27patternName = github_pat
severity = critical
line = 27
Critical
Critical Secret
Package contains a critical-looking secret pattern.
cli/errors/errors.spec.jsView on unpkg · L27Findings
3 Critical5 High5 Medium5 Low
CriticalCritical Secretcli/errors/errors.spec.js
CriticalAi Agent Control Hijackcli/mcp/installer.js
CriticalSecret Patterncli/errors/errors.spec.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processcli/audit-preflight-git.js
HighShellcli/build/executor.js
HighSame File Env Network Executioncli/license.js
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/pillars-wizard.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/pre-commit.sh
Affected versions and remediation
This report applies to @chemx/create-chemx@26.9.25-1337.
See all versions of @chemx/create-chemx for other recorded verdicts.
- Avoid installing @chemx/create-chemx@26.9.25-1337. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.