registry / create-chemx / 26.9.20-408

create-chemx@26.9.20-408

Chemical X Protocol: Private drop-in architecture starter kit and capsule generator

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The package automatically writes first-party MCP configuration during npm installation, creating an agent extension lifecycle risk. The inspected code does not establish a concrete malicious attack, so this warrants a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

The package’s npm postinstall hook runs in a consumer project.

Impact

Agent clients may expose the package’s MCP tools after configuration is loaded, without a separate setup command.

Mechanism

The hook invokes the MCP installer, which writes project-level Cursor and VS Code settings and may update Antigravity’s global settings to launch the package’s MCP server.

AI rationale

Evidence

package.jsoncli/postinstall.jscli/mcp/installer.js.cursor/mcp.json.vscode/mcp.json~/.gemini/config/mcp_config.json

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs a postinstall script that calls the MCP installer for the consumer directory.
The installer writes a Chemical X MCP entry into Cursor and VS Code project settings, and can register it in Antigravity’s global settings.
The registered command launches this package’s MCP server, locally when available or through npx otherwise.
The installer source contains logic for adding agent directives to AGENTS.md; the cited location is not part of the postinstall MCP path.
The MCP installer test checks that it creates a Cursor MCP configuration.
Scaffolding copies AGENTS.md into a newly created project when that file is available.

Evidence against

The configured MCP server is this package’s own server; the inspected excerpts do not show a hidden external payload or unrelated credential recipient.
The cited installer and scaffold locations concern configuration setup; they do not establish a separate malicious action.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/errors/errors.spec.jsView file

27patternName = github_pat severity = critical line = 27

Critical

Critical Secret

Package contains a critical-looking secret pattern.

cli/errors/errors.spec.jsView on unpkg · L27

27patternName = github_pat severity = critical line = 27

Critical

Secret Pattern

GitHub personal access token in cli/errors/errors.spec.js

cli/errors/errors.spec.jsView on unpkg · L27

cli/audit-preflight-git.jsView file

1import fs from 'node:fs'; L2: import { spawnSync } from 'node:child_process'; L3:

High

Child Process

Package source references child process execution.

cli/audit-preflight-git.jsView on unpkg · L1

cli/build/executor.jsView file

11const child = spawn(command, { L12: shell: true, L13: cwd,

High

Shell

Package source references shell execution.

cli/build/executor.jsView on unpkg · L11

cli/license.jsView file

Lines 1-23javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import os from 'node:os';

4import { spawnSync } from 'node:child_process';

cli/mcp/installer.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L20: export const mergeMcpServerConfig = (existingJsonString = '', serverDef = {}) => { L21: let parsed = { mcpServers: {} }; L22: ... L30: L31: const hasMcpServersObject = Boolean(parsed.mcpServers && typeof parsed.mcpServers === 'object'); L32: if (!hasMcpServersObject) { L33: parsed.mcpServers = {}; L34: } L35: L36: parsed.mcpServers[SERVER_KEY] = serverDef; L37: return JSON.stringify(parsed, null, 2) + '\n'; ... L90: const cursorDir = path.join(resolvedTarget, '.cursor'); Write operation from cli/mcp/installer.js: L20: export const mergeMcpServerConfig = (existingJsonString = '', serverDef = {}) => { L21: let parsed = { mcpServers: {} }; L22: ... L30: L31: const hasMcpServersObject = Boolean(parsed.mcpServers &

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/mcp/installer.jsView on unpkg · L1

cli/scaffold.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. 'no background telemetry is exfiltrated without your explicit consent.\n' + 'thank you for supporting chemical x!\n\n' ); files = loadlocalblueprintfiles(); iscommunity = true; } else { files = await fetchstarterkitfiles(licensekey); } let targetname = projectname; if (!targetname) { const isheadless = rawargs.includes('--headless') || rawargs.includes('--yes') || rawargs.includes('-y') || rawargs.includes('--ci') || rawargs.includes('--non-interactive') || rawargs.includes('--no-interactive') || boolean(process.env.ci) || process.stdout?.istty === false || process.stdin?.istty === false ||

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/scaffold.jsView on unpkg

scripts/pre-commit.shView file

•path = scripts/pre-commit.sh kind = build_helper sizeBytes = 5174 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pre-commit.shView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/errors/errors.spec.jsView file

27patternName = github_pat severity = critical line = 27

Critical

Critical Secret

Package contains a critical-looking secret pattern.

cli/errors/errors.spec.jsView on unpkg · L27

Findings

3 Critical6 High5 Medium4 Low

CriticalCritical Secretcli/errors/errors.spec.js

CriticalAi Agent Control Hijackcli/mcp/installer.js

CriticalSecret Patterncli/errors/errors.spec.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processcli/audit-preflight-git.js

HighShellcli/build/executor.js

HighSame File Env Network Executioncli/license.js

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/scaffold.js

HighPrevious Version Dangerous Deltacli/license.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to create-chemx@26.9.20-408.

See all versions of create-chemx for other recorded verdicts.

Review the evidence and your use of create-chemx@26.9.20-408 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 08:12:45.950Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.