registry / AI-agent capability abuse / chemx / 26.9.9-700

chemx@26.9.9-700

Chemical X Protocol: Private drop-in architecture starter kit and capsule generator

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The CLI has a path-traversal-style arbitrary write primitive fed by a remote response and can create AI-agent instructions. Its activation is explicit and interactive, with no lifecycle hook or demonstrated payload execution, so the package is suspicious rather than malicious.

Static reason

One or more suspicious static signals were detected.

Trigger

The user runs the create or scaffold CLI flow and supplies a license key.

Impact

A malicious or compromised service response can escape the chosen project directory and modify files writable by the user, including AI-agent configuration.

Mechanism

Remote template download with unsanitized filesystem writes and AI-rule creation.

AI rationale

Evidence

cli/index.js.chemical-x/config.json.chemical-x/device_id<targetDir>/<server-controlled relPath><targetDir>/.cursorrules

Network endpoints2

chemicalx.xophz.commycompassconsulting.com

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The explicit scaffold command downloads a server-supplied file map and writes each supplied path without validating that it stays in the target directory.
The scaffold command creates a .cursorrules file containing directives for an AI coding tool.
A license key and persistent device identifier are sent to the package service.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The network download and project writes occur only after an interactive CLI command and license flow.
No source shows secret harvesting, shell payload execution, or automatic persistence.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 25.5 KB of source, external domains: chemicalx.xophz.com, mycompassconsulting.com

Source & flagged code

5 flagged

cli/index.jsView file

Lines 1-49javascript

1#!/usr/bin/env node

3import fs from 'node:fs';

4import path from 'node:path';

5import os from 'node:os';

6import readline from 'node:readline';

7import { spawnSync } from 'node:child_process';

8import { runAudit as executeAstAudit, auditFile } from './audit.js';

High

Child Process

Package source references child process execution.

cli/index.jsView on unpkg · L6

10const rawArgs = process.argv.slice(2);

11const invokedBin = path.basename(process.argv[1] || '');

12const isCreateInvoked = invokedBin.includes('create-chemx') || (rawArgs[0] && rawArgs[0] === 'create');

14const CONFIG_DIR = path.join(os.homedir(), '.chemical-x');

15const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');

16const DEVICE_FILE = path.join(CONFIG_DIR, 'device_id');

18const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com';

19const URL_STANDARD = 'https://mycompassconsulting.com/buy/chemical-x/standard';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/index.jsView on unpkg · L6

20const URL_MASTER = 'https://mycompassconsulting.com/buy/chemical-x/master';

22if (!fs.existsSync(CONFIG_DIR)) {

23 try { fs.mkdirSync(CONFIG_DIR, { recursive: true }); } catch {}

24}

26const openBrowser = (url) => {

27 const platform = process.platform;

28 try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/index.jsView on unpkg · L6

29 if (platform === 'darwin') spawnSync('open', [url], { stdio: 'ignore' });

30 else if (platform === 'win32') spawnSync('cmd.exe', ['/c', 'start', '""', url], { stdio: 'ignore' });

31 else spawnSync('xdg-open', [url], { stdio: 'ignore' });

High

Shell

Package source references shell execution.

cli/index.jsView on unpkg · L29

32 } catch {}

33};

35const hasGum = () => {

36 try {

37 return spawnSync('which', ['gum'], { stdio: 'ignore' }).status === 0;

38 } catch {

39 return false;

40 }

41};

43const gumChoose = (options, header = '') => {

44 const args = ['choose', ...options, '--cursor.foreground=81'];

45 if (header) {

46 args.unshift(`--header=${header}`, '--header.foreground=81');

47 }

48 const res = spawnSync('gum', args, { encoding: 'utf-8', stdio: ['inherit', 'pipe', 'inherit'] });

49 return (res.stdout || '').trim();

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nst res = await fetch(`${api_base}/api/starter-kit/download`, { method: 'post', headers: { 'content-type': 'application/json' }, body: json.stringify({ licensekey: normalizedkey, deviceid }) }); const responsedata = await res.json(); if (!res.ok || !responsedata.valid) { process.stderr.write(`\x1b[31m✕ license verification failed: ${responsedata.error || 'invalid key.'}\x1b[0m\n`); process.stderr.write(`purchase key at: ${url_standard}\n\n`); process.exit(1); } savelicensekey(normalizedkey); process.stdout.write(`\x1b[32m✔ verified license for @${responsedata.githubuser || 'sponsor'}\x1b[0m\n\n`); return response

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

cli/index.jsView file

6import readline from 'node:readline'; L7: import { spawnSync } from 'node:child_process'; L8: import { runAudit as executeAstAudit, auditFile } from './audit.js';

High

Child Process

Package source references child process execution.

cli/index.jsView on unpkg · L6

29if (platform === 'darwin') spawnSync('open', [url], { stdio: 'ignore' }); L30: else if (platform === 'win32') spawnSync('cmd.exe', ['/c', 'start', '""', url], { stdio: 'ignore' }); L31: else spawnSync('xdg-open', [url], { stdio: 'ignore' });

High

Shell

Package source references shell execution.

cli/index.jsView on unpkg · L29

6import readline from 'node:readline'; L7: import { spawnSync } from 'node:child_process'; L8: import { runAudit as executeAstAudit, auditFile } from './audit.js'; ... L17: L18: const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com'; L19: const URL_STANDARD = 'https://mycompassconsulting.com/buy/chemical-x/standard';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/index.jsView on unpkg · L6

Findings

5 High3 Medium5 Low

HighChild Processcli/index.js

HighShellcli/index.js

HighSame File Env Network Executioncli/index.js

HighSandbox Evasion Gated Capabilitycli/index.js

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to chemx@26.9.9-700.

See all versions of chemx for other recorded verdicts.

Review the evidence and your use of chemx@26.9.9-700 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-09 22:42:43.391Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.