registry / @chemx/starter-kit / 26.9.13-383
@chemx/starter-kit@26.9.13-383
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest contains CLI entrypoints but no install lifecycle hook. The flagged process, network, and file operations are part of user-run workflows, with no inspected evidence of an attack.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a CLI command and chooses to scaffold, verify a license, or share an audit.
Impact
No confirmed malicious effect was established; these actions are tied to the CLI workflows.
Mechanism
The CLI writes blueprint files into a selected target, contacts its configured license service, or publishes a prompted audit to GitHub Discussions.
AI rationale
The manifest contains CLI entrypoints but no install lifecycle hook. The flagged process, network, and file operations are part of user-run workflows, with no inspected evidence of an attack.
Evidence
cli/scaffold.jscli/license.jscli/navigator-share.jscli/terminal.jspackage.json
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes CLI entrypoints and has no install lifecycle hook.
- Scaffolding is invoked through an explicit CLI workflow and writes blueprint files into its selected target directory.
- License verification is part of that workflow and sends the license key and device ID to the configured service.
- Sharing prompts for project details and publishes an audit to GitHub Discussions.
- Terminal process launches open a supplied URL or invoke gum with arguments.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcecli/navigator-share.jsView file
2import path from 'node:path';
L3: import { spawnSync } from 'node:child_process';
L4: import {
High
Child Process
Package source references child process execution.
cli/navigator-share.jsView on unpkg · L2cli/terminal.jsView file
10} else if (platform === "win32") {
L11: spawnSync("cmd.exe", ["/c", "start", '""', url], { stdio: "ignore" });
L12: } else {
High
cli/license.jsView file
3import os from 'node:os';
L4: import { spawnSync } from 'node:child_process';
L5: import {
...
L17:
L18: export const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com';
L19: export const GATEKEEPER_API_URL = process.env.COMPASS_GATEKEEPER_URL || 'https://mycompassconsulting.com/wp-json/compass/v1/gatekeeper';
Findings
5 High2 Medium5 Low
HighChild Processcli/navigator-share.js
HighShellcli/terminal.js
HighSame File Env Network Executioncli/license.js
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js
HighPrevious Version Dangerous Deltacli/license.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @chemx/starter-kit@26.9.13-383.
See all versions of @chemx/starter-kit for other recorded verdicts.
- Review the evidence and your use of @chemx/starter-kit@26.9.13-383 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.