registry / AI-agent capability abuse / chemx / 26.9.16-668

chemx@26.9.16-668

Chemical X Protocol: Private drop-in architecture starter kit and capsule generator

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Source inspection confirms agent-configuration mutation and agent-steering text, but the relevant installer is interactive and the declared postinstall target is absent. This supports a warning for agent capability risk, not a confirmed install-hook attack.

Static reason

One or more suspicious static signals were detected.

Trigger

A user selects the query-machine or all-guardrails option in the interactive installer; MCP configuration can also be installed through its setup command.

Impact

AI agents following the added instructions may be steered toward the package’s search tool; configured editors may launch the package’s MCP server.

Mechanism

The query setup appends instructions directing AI agents to use ChemX search commands. MCP setup merges a Chemical X server entry into project editor configuration while preserving other server entries.

AI rationale

Evidence

package.jsoncli/installer.jscli/mcp/installer.jscli/mcp/installer.spec.jsAGENTS.md.cursor/mcp.json.vscode/mcp.json

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The installer writes instructions into an existing AGENTS.md telling AI agents to use the package’s search command before broad searches.
The query-machine setup is selected through an interactive installer; the source inspected does not show this write running from the npm lifecycle hook.
The MCP installer adds a package-owned server entry to project Cursor and VS Code configuration when invoked.
package.json declares a postinstall script, but its referenced scripts/postinstall.mjs file is absent from the package snapshot.

Evidence against

The AGENTS.md modification is part of an interactive setup choice, rather than a confirmed automatic install-time action.
The inspected MCP setup preserves existing MCP server entries and adds a named Chemical X entry.
The postinstall hook’s referenced file is missing, so the snapshot does not establish that it executes.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Source & flagged code

6 flagged

package.jsonView file

Lines 30-69json

30 ".": "./cli/index.js",

31 "./audit": "./cli/audit.js",

32 "./build": "./cli/build.js",

33 "./search": "./cli/search.js",

34 "./mcp": "./cli/mcp/index.js",

35 "./reader": "./cli/reader.js",

36 "./patcher": "./cli/patcher.js"

37 },

38 "scripts": {

39 "publish:both": "node scripts/publish-both.mjs",

40 "test": "node --test cli/audit/*.spec.js cli/mcp/*.spec.js cli/*.spec.js",

41 "typecheck": "tsc --noEmit",

42 "create-capsule": "node cli/index.js",

43 "audit": "node cli/index.js audit",

44 "ci:audit": "node cli/index.js audit --ci --dir=cli",

45 "chemx": "node cli/index.js",

46 "q": "node cli/index.js q",

47 "search": "node cli/index.js search",

48 "mcp": "node cli/index.js mcp",

49 "install-mcp": "node cli/index.js install-mcp",

50 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "read": "node cli/index.js read",

52 "patch": "node cli/index.js patch"

53 },

54 "dependencies": {

55 "@babel/parser": "^7.29.8",

56 "@babel/traverse": "^7.29.8",

57 "@babel/types": "^7.29.8",

58 "react": "^18.3.1",

59 "react-dom": "^18.3.1"

60 },

61 "devDependencies": {

62 "@types/babel__traverse": "^7.28.0",

63 "@types/node": "^22.20.2",

64 "@types/react": "^18.3.31",

65 "@types/react-dom": "^18.3.7",

66 "typescript": "^5.9.3"

67 }

68}

cli/audit-preflight-git.jsView file

1import fs from 'node:fs'; L2: import { spawnSync } from 'node:child_process'; L3:

High

Child Process

Package source references child process execution.

cli/audit-preflight-git.jsView on unpkg · L1

cli/terminal.jsView file

Lines 1-30javascript

1import readline from "node:readline";

2import { spawnSync } from "node:child_process";

3import { formatChemicalXGradient, ANSI } from "./theme.js";

5export const openBrowser

cli/license.jsView file

Lines 1-23javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import os from 'node:os';

4import { spawnSync } from 'node:child_process';

cli/scaffold.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js'; import { obtainlicensekey, fetchstarterkitfiles, loadlocalblueprintfiles } from './license.js'; export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => { renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)'); const licensekey = await obtainlicensekey(rawargs, onrunaudit); let iscommunity = false; let files = {}; if (!licensekey) { process.stdout.write( '\n\x1b[38;2;98;201;255m⚡ chemical x: community edition (free)\x1b[0m\n' + 'the community version is free because

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/scaffold.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/audit-preflight-git.jsView file

1import fs from 'node:fs'; L2: import { spawnSync } from 'node:child_process'; L3:

High

Child Process

Package source references child process execution.

cli/audit-preflight-git.jsView on unpkg · L1

Findings

5 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processcli/audit-preflight-git.js

HighShellcli/terminal.js

HighSame File Env Network Executioncli/license.js

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to chemx@26.9.16-668.

See all versions of chemx for other recorded verdicts.

Review the evidence and your use of chemx@26.9.16-668 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 06:56:56.283Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.