create-chemx@26.9.11-362: Remote code execution – flagged

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No automatic lifecycle behavior or confirmed credential exfiltration is present. However, the remote asset installer has a concrete path-traversal arbitrary-write risk during an explicit scaffold operation.

Static reason

No blocking static signals were detected.

Trigger

The user runs the create or scaffold CLI flow with a license key.

Impact

Potential arbitrary file overwrite and delivery of untrusted project files during scaffolding.

Mechanism

Remote file-map download followed by unchecked path construction and file writes.

AI rationale

No automatic lifecycle behavior or confirmed credential exfiltration is present. However, the remote asset installer has a concrete path-traversal arbitrary-write risk during an explicit scaffold operation.

Evidence

cli/license.jscli/scaffold.js.chemical-x/config.json.chemical-x/device_id.cursorrules

Network endpoints1

chemicalx.xophz.com/api/starter-kit/download

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The scaffold command downloads a server-provided file map and writes each supplied path without validating that it remains inside the target directory.
The same explicit scaffold command creates a Cursor rules file in the newly created project.
The package can persist a device identifier and supplied license key in the user's home configuration directory when its CLI is invoked.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
Network download and project writes occur only after the user runs a scaffold command and provides a license key.
Git hooks and CI workflow writes are behind an interactive, explicit install command.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

Source & flagged code

5 flagged

cli/scaffold.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js'; import { obtainlicensekey, fetchstarterkitfiles, checkorpromptevaluation } from './license.js'; export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => { renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)'); const licensekey = await obtainlicensekey(rawargs, onrunaudit); if (!licensekey) { process.stderr.write('\x1b[31m✕ valid license key is required to scaffold blueprints.\x1b[0m\n'); process.exit(1); } let targetname = projectname; if (!targetname) { targetname =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/scaffold.jsView on unpkg

37for (const [relPath, content] of Object.entries(files)) { const fullPath = path.join(targetDir, relPath); const dirName = path.dirname(fullPath); if (!fs.existsSync(dirName)) { fs.mkdirSync(dirName, { recursive: true }); } fs.writeFileSync(fullPath, content, 'utf-8');

Medium

Ai Review Evidence

The scaffold command downloads a server-provided file map and writes each supplied path without validating that it remains inside the target directory.

cli/scaffold.jsView on unpkg · L37

47const cursorRulesPath = path.join(targetDir, '.cursorrules'); if (!fs.existsSync(cursorRulesPath)) { const rules = '# Chemical X Molecular Architecture Directives\nStrictly follow AGENTS.md rules. Never exceed 500 lines per file. All molecule capsules must stay under 100 lines.\n'; fs.writeFileSync(cursorRulesPath, rules, 'utf-8');

Medium

Ai Review Evidence

The same explicit scaffold command creates a Cursor rules file in the newly created project.

cli/scaffold.jsView on unpkg · L47

cli/license.jsView file

292const res = await fetch(`${API_BASE}/api/starter-kit/download`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ licenseKey: normalizedKey, deviceId }) }); const responseData = await res.json(); const isSuccess = Boolean(res.ok && responseData.valid);

Medium

Ai Review Evidence

The scaffold command downloads a server-provided file map and writes each supplied path without validating that it remains inside the target directory.

cli/license.jsView on unpkg · L292

12export const CONFIG_DIR = path.join(os.homedir(), '.chemical-x'); export const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json'); export const DEVICE_FILE = path.join(CONFIG_DIR, 'device_id'); export const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com';

Medium

Ai Review Evidence

The package can persist a device identifier and supplied license key in the user's home configuration directory when its CLI is invoked.

cli/license.jsView on unpkg · L12

Source & flagged code

5 flagged · loading source

cli/scaffold.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js'; import { obtainlicensekey, fetchstarterkitfiles, checkorpromptevaluation } from './license.js'; export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => { renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)'); const licensekey = await obtainlicensekey(rawargs, onrunaudit); if (!licensekey) { process.stderr.write('\x1b[31m✕ valid license key is required to scaffold blueprints.\x1b[0m\n'); process.exit(1); } let targetname = projectname; if (!targetname) { targetname =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/scaffold.jsView on unpkg

37for (const [relPath, content] of Object.entries(files)) { const fullPath = path.join(targetDir, relPath); const dirName = path.dirname(fullPath); if (!fs.existsSync(dirName)) { fs.mkdirSync(dirName, { recursive: true }); } fs.writeFileSync(fullPath, content, 'utf-8');

Medium

Ai Review Evidence

The scaffold command downloads a server-provided file map and writes each supplied path without validating that it remains inside the target directory.

cli/scaffold.jsView on unpkg · L37

Findings

1 High6 Medium5 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidencecli/scaffold.js

MediumAi Review Evidencecli/license.js

MediumAi Review Evidencecli/scaffold.js

MediumAi Review Evidencecli/license.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code