create-chemx@26.9.12-1140
Chemical X Protocol: Private drop-in architecture starter kit and capsule generator
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has no install lifecycle execution, but its user-invoked scaffold downloads server-controlled content and writes unchecked paths to disk. This creates a concrete remote payload and path-traversal capability that warrants a warning.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs the create or init CLI flow and supplies a licence key.
Impact
A compromised or malicious endpoint can place arbitrary files, including outside the intended project through traversal paths.
Mechanism
Remote file-map download followed by unchecked local writes.
AI rationale
The package has no install lifecycle execution, but its user-invoked scaffold downloads server-controlled content and writes unchecked paths to disk. This creates a concrete remote payload and path-traversal capability that warrants a warning.
Evidence
cli/license.jscli/scaffold.js~/.chemical-x/device_id~/.chemical-x/config.jsonuser-selected project directoryuser-selected project directory/.cursorrules
Network endpoints1
chemicalx.xophz.com/api/starter-kit/download
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The scaffold fetches server-provided starter-kit content after sending a licence key and persistent device identifier.
- Returned file paths are joined and written without validating that they remain inside the chosen project directory.
- The scaffold also writes an AI-editor rules file into the created project.
Evidence against
- package.json has no install lifecycle hook or self-dependency.
- The risky download-and-write path is reached only by an explicit create or init CLI command after licence input.
- No source path executes the downloaded content during scaffolding.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcecli/navigator-share.jsView file
2import path from 'node:path';
L3: import { spawnSync } from 'node:child_process';
L4: import {
High
Child Process
Package source references child process execution.
cli/navigator-share.jsView on unpkg · L2cli/terminal.jsView file
10} else if (platform === "win32") {
L11: spawnSync("cmd.exe", ["/c", "start", '""', url], { stdio: "ignore" });
L12: } else {
High
cli/license.jsView file
3import os from 'node:os';
L4: import { spawnSync } from 'node:child_process';
L5: import {
...
L17:
L18: export const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com';
L19: export const URL_LEARN = 'https://chemicalx.xophz.com';
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
cli/license.jsView on unpkg · L3•matchType = previous_version_dangerous_delta
matchedPackage = create-chemx@26.9.12-272
matchedIdentity = npm:Y3JlYXRlLWNoZW14:26.9.12-272
similarity = 0.565
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
cli/license.jsView on unpkgcli/scaffold.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import fs from 'node:fs';
import path from 'node:path';
import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js';
import { obtainlicensekey, fetchstarterkitfiles } from './license.js';
export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => {
renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)');
const licensekey = await obtainlicensekey(rawargs, onrunaudit);
if (!licensekey) {
process.stderr.write('\x1b[31m✕ valid license key is required to scaffold blueprints.\x1b[0m\n');
process.exit(1);
}
let targetname = projectname;
if (!targetname) {
targetname = hasgum()
? guminpu
High
Trigger Reachable External Ai Agent Control Surface Mutation
Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.
cli/scaffold.jsView on unpkgFindings
5 High2 Medium5 Low
HighChild Processcli/navigator-share.js
HighShellcli/terminal.js
HighSame File Env Network Executioncli/license.js
HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js
HighPrevious Version Dangerous Deltacli/license.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to create-chemx@26.9.12-1140.
See all versions of create-chemx for other recorded verdicts.
- Review the evidence and your use of create-chemx@26.9.12-1140 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.