@chemx/create-chemx@26.9.9-632
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is not an automatic install-time attack, but it exposes users to unvalidated server-controlled project writes and changes an AI-agent control surface. The explicit trigger prevents a publish block, while the remote payload mechanism warrants a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs create-chemx, chemx create, or chemx init and supplies a license key.
Impact
A compromised or malicious service response can place arbitrary content or paths in the user's project; the CLI also changes the project's AI-agent behavior.
Mechanism
Remote template download followed by unchecked project-file writes and AI instruction creation.
AI rationale
This is not an automatic install-time attack, but it exposes users to unvalidated server-controlled project writes and changes an AI-agent control surface. The explicit trigger prevents a publish block, while the remote payload mechanism warrants a warning.
Evidence
package.jsoncli/index.js~/.chemical-x/config.json~/.chemical-x/device_id<targetDir>/<server-supplied relPath><targetDir>/.cursorrules
Network endpoints1
chemicalx.xophz.com/api/starter-kit/download
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The executable is exposed through two user-invoked npm bins.
- It posts a license key and persistent device identifier to chemicalx.xophz.com, then accepts a server-supplied file map.
- Server-provided paths and contents are written without path validation into the selected project directory.
- The scaffold command creates a .cursorrules AI-agent instruction file.
- It persists the entered license key in the user's home configuration directory.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The behavior requires an explicit CLI invocation; import or installation does not run the executable.
- Child-process calls are limited to browser opening and the optional gum interface; no remote command execution is present.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcecli/index.jsView file
6import readline from 'node:readline';
L7: import { spawnSync } from 'node:child_process';
L8:
High
28if (platform === 'darwin') spawnSync('open', [url], { stdio: 'ignore' });
L29: else if (platform === 'win32') spawnSync('cmd.exe', ['/c', 'start', '""', url], { stdio: 'ignore' });
L30: else spawnSync('xdg-open', [url], { stdio: 'ignore' });
High
6import readline from 'node:readline';
L7: import { spawnSync } from 'node:child_process';
L8:
...
L16:
L17: const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com';
L18: const URL_STANDARD = 'https://mycompassconsulting.com/buy/chemical-x/standard';
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
cli/index.jsView on unpkg · L6Findings
5 High3 Medium5 Low
HighChild Processcli/index.js
HighShellcli/index.js
HighSame File Env Network Executioncli/index.js
HighSandbox Evasion Gated Capabilitycli/index.js
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @chemx/create-chemx@26.9.9-632.
See all versions of @chemx/create-chemx for other recorded verdicts.
- Review the evidence and your use of @chemx/create-chemx@26.9.9-632 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.