registry / AI-agent capability abuse / chemx / 26.9.12-1140

chemx@26.9.12-1140

Chemical X Protocol: Private drop-in architecture starter kit and capsule generator

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is not an install-time malware chain, but it exposes meaningful explicit-command risks: unvalidated remote file paths and project-control mutations. The behavior warrants a warning rather than a block because it requires user invocation and no automatic lifecycle trigger exists.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user runs create/init, hook/setup-ci, or audit --share.

Impact

A compromised service response could write outside the intended scaffold directory; explicit setup can add repository automation and AI-editor guidance.

Mechanism

Remote starter-file download and explicit project automation setup.

AI rationale

Evidence

cli/license.jscli/scaffold.jscli/index.jscli/installer.jscli/audit/social-publisher.js.cursorrules.git/hooks/pre-commit.github/workflows/chemx-audit.yml.chemx/config.json

Network endpoints2

chemicalx.xophz.com/api/starter-kit/downloadapi.github.com/graphql

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The explicit scaffold command downloads server-supplied files and writes them into the selected project without validating returned relative paths.
The explicit guardrail setup command can install an executable Git hook and a GitHub Actions workflow in the current project.
The explicit sharing feature reads a GitHub token from the environment and sends audit content to GitHub.

Evidence against

The manifest has no preinstall, install, postinstall, or prepare lifecycle hook.
All project and agent-control writes are reached through named CLI commands and interactive setup, not package installation or import.
No obfuscation, dynamic code evaluation, self-dependency, or automatic secret collection was found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

5 flagged

cli/navigator-share.jsView file

Lines 1-22javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import { spawnSync } from 'node:child_process';

4import {

High

Child Process

Package source references child process execution.

cli/navigator-share.jsView on unpkg · L2

5 hasGum,

6 gumChoose,

7 gumInput,

8 promptQuestion,

9 openBrowser

10} from './terminal.js';

11import {

12 detectGitRepoInfo,

13 detectGitHubUser,

14 getAuditBaseline,

15 createSnapshotFromReport,

16 getAuditHistory,

17 generateTransformationDiscussionContent,

18 generateDiscussionContent,

19 publishDiscussion,

20 publishOrUpdateDiscussion,

21 getStoredDiscussion,

22 copyToClipboard,

cli/terminal.jsView file

Lines 1-30javascript

1import readline from "node:readline";

2import { spawnSync } from "node:child_process";

3import { formatChemicalXGradient, ANSI } from "./theme.js";

5export const openBrowser

cli/license.jsView file

Lines 1-23javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import os from 'node:os';

4import { spawnSync } from 'node:child_process';

cli/scaffold.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js'; import { obtainlicensekey, fetchstarterkitfiles } from './license.js'; export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => { renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)'); const licensekey = await obtainlicensekey(rawargs, onrunaudit); if (!licensekey) { process.stderr.write('\x1b[31m✕ valid license key is required to scaffold blueprints.\x1b[0m\n'); process.exit(1); } let targetname = projectname; if (!targetname) { targetname = hasgum() ? guminpu

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/scaffold.jsView on unpkg

Source & flagged code

5 flagged · loading source

cli/navigator-share.jsView file

2import path from 'node:path'; L3: import { spawnSync } from 'node:child_process'; L4: import {

High

Child Process

Package source references child process execution.

cli/navigator-share.jsView on unpkg · L2

cli/terminal.jsView file

10} else if (platform === "win32") { L11: spawnSync("cmd.exe", ["/c", "start", '""', url], { stdio: "ignore" }); L12: } else {

High

Shell

Package source references shell execution.

cli/terminal.jsView on unpkg · L10

cli/license.jsView file

3import os from 'node:os'; L4: import { spawnSync } from 'node:child_process'; L5: import { ... L17: L18: export const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com'; L19: export const URL_LEARN = 'https://chemicalx.xophz.com';

Findings

5 High2 Medium5 Low

HighChild Processcli/navigator-share.js

HighShellcli/terminal.js

HighSame File Env Network Executioncli/license.js

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js

HighPrevious Version Dangerous Deltacli/license.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to chemx@26.9.12-1140.

See all versions of chemx for other recorded verdicts.

Review the evidence and your use of chemx@26.9.12-1140 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 19:06:33.384Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.