registry / Credential exfiltration / create-chemx / 26.9.13-272

create-chemx@26.9.13-272

Chemical X Protocol: Private drop-in architecture starter kit and capsule generator

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The configurable API destination and license-key request create a concrete conditional credential exposure risk, so this warrants a warning. The inspected source does not establish covert theft or another attack supporting a block.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user invokes scaffolding or initialization and provides or has a cached license key.

Impact

A misconfigured or untrusted endpoint can receive the license key; the default destination is the package's service.

Mechanism

The CLI uses CHEMICAL_X_API_URL as the API base when set, then posts the license key and device ID without validating the destination.

AI rationale

Evidence

cli/license.js

Network endpoints1

chemicalx.xophz.com

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI sends a license key to an endpoint selected by CHEMICAL_X_API_URL, without restricting that endpoint to the Chemical X service.
Scaffolding and license verification run from explicit CLI commands; no install lifecycle hooks are declared.

Evidence against

The default license verification endpoint is the package's Chemical X service.
Build execution is part of an explicit build or run command and uses the detected or caller-supplied project build command.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 57 file(s), 351 KB of source, external domains: api.github.com, chemicalx.xophz.com, github.com, img.shields.io, mycompassconsulting.com, www.w3.org

Source & flagged code

5 flagged

cli/navigator-share.jsView file

Lines 1-22javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import { spawnSync } from 'node:child_process';

4import {

High

Child Process

Package source references child process execution.

cli/navigator-share.jsView on unpkg · L2

5 hasGum,

6 gumChoose,

7 gumInput,

8 promptQuestion,

9 openBrowser

10} from './terminal.js';

11import {

12 detectGitRepoInfo,

13 detectGitHubUser,

14 getAuditBaseline,

15 createSnapshotFromReport,

16 getAuditHistory,

17 generateTransformationDiscussionContent,

18 generateDiscussionContent,

19 publishDiscussion,

20 publishOrUpdateDiscussion,

21 getStoredDiscussion,

22 copyToClipboard,

cli/terminal.jsView file

Lines 1-30javascript

1import readline from "node:readline";

2import { spawnSync } from "node:child_process";

3import { formatChemicalXGradient, ANSI } from "./theme.js";

5export const openBrowser

cli/license.jsView file

Lines 1-23javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import os from 'node:os';

4import { spawnSync } from 'node:child_process';

cli/scaffold.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import path from 'node:path'; import { hasgum, guminput, promptquestion, renderbanner } from './terminal.js'; import { obtainlicensekey, fetchstarterkitfiles } from './license.js'; export const runscaffold = async (projectname, rawargs = [], onrunaudit = null) => { renderbanner('chemical x: molecular architecture scaffolder (npm create chemx)'); const licensekey = await obtainlicensekey(rawargs, onrunaudit); if (!licensekey) { process.stderr.write('\x1b[31m✕ valid license key is required to scaffold blueprints.\x1b[0m\n'); process.exit(1); } let targetname = projectname; if (!targetname) { targetname = hasgum() ? guminpu

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/scaffold.jsView on unpkg

cli/build/executor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = create-chemx@26.9.12-1140 matchedIdentity = npm:Y3JlYXRlLWNoZW14:26.9.12-1140 similarity = 0.959 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/build/executor.jsView on unpkg

Source & flagged code

5 flagged · loading source

cli/navigator-share.jsView file

2import path from 'node:path'; L3: import { spawnSync } from 'node:child_process'; L4: import {

High

Child Process

Package source references child process execution.

cli/navigator-share.jsView on unpkg · L2

cli/terminal.jsView file

10} else if (platform === "win32") { L11: spawnSync("cmd.exe", ["/c", "start", '""', url], { stdio: "ignore" }); L12: } else {

High

Shell

Package source references shell execution.

cli/terminal.jsView on unpkg · L10

cli/license.jsView file

3import os from 'node:os'; L4: import { spawnSync } from 'node:child_process'; L5: import { ... L17: L18: export const API_BASE = process.env.CHEMICAL_X_API_URL || 'https://chemicalx.xophz.com'; L19: export const URL_LEARN = 'https://chemicalx.xophz.com';

Findings

5 High2 Medium5 Low

HighChild Processcli/navigator-share.js

HighShellcli/terminal.js

HighSame File Env Network Executioncli/license.js

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js

HighPrevious Version Dangerous Deltacli/build/executor.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to create-chemx@26.9.13-272.

See all versions of create-chemx for other recorded verdicts.

Review the evidence and your use of create-chemx@26.9.13-272 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 08:07:52.266Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.