create-chemx@26.9.11-481: Agent extension lifecycle risk

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package does not execute automatically at installation and no concrete credential theft or destructive payload was found. Its explicit scaffold flow nevertheless combines remote, unpinned project content with an AI-agent configuration write.

Static reason

No blocking static signals were detected.

Trigger

Running the create/scaffold CLI command with a license key.

Impact

A vendor-controlled response can determine generated project files; Cursor behavior is influenced by the added rules file.

Mechanism

Remote template download followed by generated-project and Cursor-rule writes.

AI rationale

The package does not execute automatically at installation and no concrete credential theft or destructive payload was found. Its explicit scaffold flow nevertheless combines remote, unpinned project content with an AI-agent configuration write.

Evidence

cli/license.jscli/scaffold.js.chemical-x/device_id.chemical-x/config.json<new-project>/**<new-project>/.cursorrules

Network endpoints1

chemicalx.xophz.com/api/starter-kit/download

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The user-invoked scaffold downloads a server-supplied file map and writes each entry into the new project.
The scaffold creates a Cursor rules file containing AI-agent directives in the generated project.
The package stores a persistent device identifier under the user's Chemical X configuration directory.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
Network and project writes occur through explicit CLI scaffold or audit commands, not on package installation.
No secret harvesting, shell payload execution, self-dependency, or stealth persistence was found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 35 file(s), 218 KB of source, external domains: api.github.com, chemicalx.xophz.com, github.com, img.shields.io, mycompassconsulting.com

Source & flagged code

5 flagged

cli/scaffold.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js'; import { obtainlicensekey, fetchstarterkitfiles, checkorpromptevaluation } from './license.js'; export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => { renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)'); const licensekey = await obtainlicensekey(rawargs, onrunaudit); if (!licensekey) { process.stderr.write('\x1b[31m✕ valid license key is required to scaffold blueprints.\x1b[0m\n'); process.exit(1); } let targetname = projectname; if (!targetname) { targetname =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/scaffold.jsView on unpkg

37for (const [relPath, content] of Object.entries(files)) { const fullPath = path.join(targetDir, relPath); const dirName = path.dirname(fullPath); if (!fs.existsSync(dirName)) { fs.mkdirSync(dirName, { recursive: true }); } fs.writeFileSync(fullPath, content, 'utf-8'); process.stdout.write(` \x1b[32m✔\x1b[0m ${relPath}\n`); }

Medium

Ai Review Evidence

The user-invoked scaffold downloads a server-supplied file map and writes each entry into the new project.

cli/scaffold.jsView on unpkg · L37

47const cursorRulesPath = path.join(targetDir, '.cursorrules'); if (!fs.existsSync(cursorRulesPath)) { const rules = '# Chemical X Molecular Architecture Directives\nStrictly follow AGENTS.md rules. Never exceed 500 lines per file. All molecule capsules must stay under 100 lines.\n'; fs.writeFileSync(cursorRulesPath, rules, 'utf-8'); process.stdout.write(' \x1b[32m✔\x1b[0m .cursorrules\n'); }

Medium

Ai Review Evidence

The scaffold creates a Cursor rules file containing AI-agent directives in the generated project.

cli/scaffold.jsView on unpkg · L47

cli/license.jsView file

292const res = await fetch(`${API_BASE}/api/starter-kit/download`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ licenseKey: normalizedKey, deviceId }) });

Medium

Ai Review Evidence

The user-invoked scaffold downloads a server-supplied file map and writes each entry into the new project.

cli/license.jsView on unpkg · L292

12export const CONFIG_DIR = path.join(os.homedir(), '.chemical-x'); export const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json'); export const DEVICE_FILE = path.join(CONFIG_DIR, 'device_id'); export const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com'; export const URL_LEARN = 'https://chemicalx.xophz.com';

Medium

Ai Review Evidence

The package stores a persistent device identifier under the user's Chemical X configuration directory.

cli/license.jsView on unpkg · L12

Source & flagged code

5 flagged · loading source

cli/scaffold.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js'; import { obtainlicensekey, fetchstarterkitfiles, checkorpromptevaluation } from './license.js'; export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => { renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)'); const licensekey = await obtainlicensekey(rawargs, onrunaudit); if (!licensekey) { process.stderr.write('\x1b[31m✕ valid license key is required to scaffold blueprints.\x1b[0m\n'); process.exit(1); } let targetname = projectname; if (!targetname) { targetname =

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/scaffold.jsView on unpkg

37for (const [relPath, content] of Object.entries(files)) { const fullPath = path.join(targetDir, relPath); const dirName = path.dirname(fullPath); if (!fs.existsSync(dirName)) { fs.mkdirSync(dirName, { recursive: true }); } fs.writeFileSync(fullPath, content, 'utf-8'); process.stdout.write(` \x1b[32m✔\x1b[0m ${relPath}\n`); }

Medium

Ai Review Evidence

The user-invoked scaffold downloads a server-supplied file map and writes each entry into the new project.

cli/scaffold.jsView on unpkg · L37

Findings

1 High6 Medium5 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidencecli/license.js

MediumAi Review Evidencecli/scaffold.js

MediumAi Review Evidencecli/license.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code