registry / Staged payload carrier / chemx / 26.9.9-786

chemx@26.9.9-786

Chemical X Protocol: Private drop-in architecture starter kit and capsule generator

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The source supports a warning for a remotely supplied project scaffold, activated only by an explicit CLI setup command. It does not establish concrete attack behavior or an install-time control-surface mutation warranting a block.

Static reason

One or more suspicious static signals were detected.

Trigger

The user invokes the chemx create/scaffold or init command and supplies a license key.

Impact

The API response can determine files created in the project; no concrete malicious behavior in those returned files is established by inspected source.

Mechanism

The CLI POSTs the license key and device ID to the configured starter-kit API, then writes returned file contents beneath the target directory.

AI rationale

Evidence

cli/index.js

Network endpoints1

chemicalx.xophz.com

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest exposes cli/index.js as the chemx and create-chemx commands; it has no install lifecycle hook.
Scaffold and init commands request a license and explicitly fetch starter-kit files from the configured API endpoint.
The CLI writes returned remote file contents into a project directory, so the service controls files installed by an invoked setup command.

Evidence against

The fetch and project writes occur through scaffold/init commands selected by the caller, rather than automatically during installation.
The CLI refuses to scaffold without a license key, and scaffold refuses to write into an existing non-empty target directory.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 28.4 KB of source, external domains: chemicalx.xophz.com, mycompassconsulting.com

Source & flagged code

5 flagged

cli/index.jsView file

Lines 1-54javascript

1#!/usr/bin/env node

3import fs from "node:fs";

4import path from "node:path";

5import os from "node:os";

6import readline from "node:readline";

7import { spawnSync } from "node:child_process";

8import { runAudit as executeAstAudit, auditFile } from "./audit.js";

High

Child Process

Package source references child process execution.

cli/index.jsView on unpkg · L6

10const rawArgs = process.argv.slice(2);

11const invokedBin = path.basename(process.argv[1] || "");

12const isCreateInvoked =

13 invokedBin.includes("create-chemx") || (rawArgs[0] && rawArgs[0] === "create");

15const CONFIG_DIR = path.join(os.homedir(), ".chemical-x");

16const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");

17const DEVICE_FILE = path.join(CONFIG_DIR, "device_id");

19const API_BASE = process.env.CHEMICAL_X_API_URL || "https://chemicalx.xophz.com";

20const URL_LEARN = "https://chemicalx.xophz.com";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/index.jsView on unpkg · L6

21const URL_STANDARD = "https://mycompassconsulting.com/buy/chemical-x/standard";

22const URL_MASTER = "https://mycompassconsulting.com/buy/chemical-x/master";

24if (!fs.existsSync(CONFIG_DIR)) {

25 try {

26 fs.mkdirSync(CONFIG_DIR, { recursive: true });

27 } catch {}

28}

30const openBrowser = (url) => {

31 const platform = process.platform;

32 try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/index.jsView on unpkg · L6

33 if (platform === "darwin") spawnSync("open", [url], { stdio: "ignore" });

34 else if (platform === "win32")

35 spawnSync("cmd.exe", ["/c", "start", '""', url], { stdio: "ignore" });

36 else spawnSync("xdg-open", [url], { stdio: "ignore" });

High

Shell

Package source references shell execution.

cli/index.jsView on unpkg · L34

37 } catch {}

38};

40const hasGum = () => {

41 try {

42 return spawnSync("which", ["gum"], { stdio: "ignore" }).status === 0;

43 } catch {

44 return false;

45 }

46};

48const gumChoose = (options, header = "") => {

49 const args = ["choose"];

50 if (header) {

51 args.push(`--header=${header}`, "--header.foreground=81");

52 }

53 args.push("--cursor.foreground=81", ...options);

54 const res = spawnSync("gum", args, { encoding: "utf-8", stdio: ["inherit", "pipe", "inherit"] });

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. method: "post", headers: { "content-type": "application/json" }, body: json.stringify({ licensekey: normalizedkey, deviceid }) }); const responsedata = await res.json(); if (!res.ok || !responsedata.valid) { process.stderr.write( `\x1b[31m✕ license verification failed: ${responsedata.error || "invalid key."}\x1b[0m\n` ); process.stderr.write(`purchase key at: ${url_standard}\n\n`); process.exit(1); } savelicensekey(normalizedkey); process.stdout.write( `\x1b[32m✔ verified license for @${responsedata.githubuser || "sponsor"}\x1b[0m\n\n` ); return responsedata.files || {}; } catch (err) { pr

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

cli/index.jsView file

6import readline from "node:readline"; L7: import { spawnSync } from "node:child_process"; L8: import { runAudit as executeAstAudit, auditFile } from "./audit.js";

High

Child Process

Package source references child process execution.

cli/index.jsView on unpkg · L6

34else if (platform === "win32") L35: spawnSync("cmd.exe", ["/c", "start", '""', url], { stdio: "ignore" }); L36: else spawnSync("xdg-open", [url], { stdio: "ignore" });

High

Shell

Package source references shell execution.

cli/index.jsView on unpkg · L34

6import readline from "node:readline"; L7: import { spawnSync } from "node:child_process"; L8: import { runAudit as executeAstAudit, auditFile } from "./audit.js"; ... L18: L19: const API_BASE = process.env.CHEMICAL_X_API_URL || "https://chemicalx.xophz.com"; L20: const URL_LEARN = "https://chemicalx.xophz.com";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/index.jsView on unpkg · L6

Findings

5 High3 Medium5 Low

HighChild Processcli/index.js

HighShellcli/index.js

HighSame File Env Network Executioncli/index.js

HighSandbox Evasion Gated Capabilitycli/index.js

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to chemx@26.9.9-786.

See all versions of chemx for other recorded verdicts.

Review the evidence and your use of chemx@26.9.9-786 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 06:54:32.857Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.