registry / create-chemx / 26.9.25-1337

create-chemx@26.9.25-1337

Chemical X Protocol: Private drop-in architecture starter kit and capsule generator

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Static inspection confirmed an automatic postinstall mutation of agent MCP configuration, limited to this package’s own server. Under the agent integration policy, this first-party extension setup warrants a warning, but the inspected sources do not establish a concrete attack requiring a block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package through npm runs its postinstall hook.

Impact

Agents using those configurations can invoke the package’s MCP server after installation. No remote payload or unrelated agent server was established in the inspected sources.

Mechanism

The hook calls the MCP installer for the consumer directory; the installer merges a `chemical-x` server entry into project configuration and into an existing Antigravity user configuration.

AI rationale

Evidence

package.jsoncli/postinstall.jscli/mcp/installer.js.cursor/mcp.json.vscode/mcp.json~/.gemini/config/mcp_config.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`package.json` defines a `postinstall` hook that runs `cli/postinstall.js`; that hook targets the consumer directory and calls `installAllMcpConfigs` automatically.
The automatic installer adds this package’s MCP server to project configuration and, when the Antigravity config directory exists, merges an entry into the user-level config.
The configured server invokes the local `create-chemx` CLI or `npm exec` for `chemx`; inspected code does not show a remote payload or unrelated server being installed.
The AGENTS.md directives and pillar steering files are written by separate installer and wizard paths, not by the MCP postinstall path.
The inspected sources show a real automatic agent configuration change, but one limited to first-party MCP setup; this supports a warning rather than a confirmed attack.

Evidence against

The hook invokes only `installAllMcpConfigs`; the inspected caller does not invoke the AGENTS.md installer or pillars wizard.
The MCP installer merges its named `chemical-x` server entry into existing configuration, and Antigravity setup is conditional on an existing config directory.

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = node cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/errors/errors.spec.jsView file

Lines 7-47javascript

7 maskSensitiveTokens,

8 normalizeHomePath,

9 sanitizeText,

10 sanitizeStackTrace

11} from './sanitizer.js';

12import {

13 buildIssueTitle,

14 buildIssueBody,

15 buildIssueWebUrl,

16 formatIssueContent

17} from './formatter.js';

18import {

19 handleError,

20 resolveTargetIssuesRepo,

21 saveIssueArtifact

22} from './catcher.js';

23import { withErrorCatcher } from './index.js';

25describe('Universal Error Catcher: Sanitizer', () => {

26 it('masks GitHub personal access tokens and npm tokens', () => {

27 const input = 'Failed with token ghp_123456789012345678901234567890123456 and npm_abcdefghijklmnopqrstuvwxyz012345';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

cli/errors/errors.spec.jsView on unpkg · L27

Critical

Secret Pattern

GitHub personal access token in cli/errors/errors.spec.js

cli/errors/errors.spec.jsView on unpkg · L27

28 const sanitized = maskSensitiveTokens(input);

29 assert.ok(!sanitized.includes('ghp_1234567890'));

30 assert.ok(!sanitized.includes('npm_abcdefgh'));

31 assert.ok(sanitized.includes('[REDACTED_SECRET]'));

32 });

34 it('masks Bearer tokens and api-key parameters', () => {

35 const input = 'Authorization: Bearer mySecretToken123456789\napiKey="superSecretApiKey123"';

36 const sanitized = maskSensitiveTokens(input);

37 assert.ok(!sanitized.includes('mySecretToken123456789'));

38 assert.ok(!sanitized.includes('superSecretApiKey123'));

39 assert.ok(sanitized.includes('Bearer [REDACTED]'));

40 });

42 it('normalizes home directory paths', () => {

43 const home = os.homedir();

44 const input = `Error reading file in ${home}/my-project/index.ts`;

45 const normalized = normalizeHomePath(input);

46 assert.ok(!normalized.includes(home));

47 assert.ok(normalized.includes('~/my-project/index.ts'));

cli/audit-preflight-git.jsView file

Lines 1-21javascript

1import fs from 'node:fs';

2import { spawnSync } from 'node:child_process';

High

Child Process

Package source references child process execution.

cli/audit-preflight-git.jsView on unpkg · L1

4const SOURCE_FILE_PATTERN = /\.

cli/build/executor.jsView file

Lines 1-31javascript

1import { spawn } from 'node:child_process';

3export const executeBuild = (command, cwd = process.cwd(), options = {})

cli/license.jsView file

Lines 1-23javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import os from 'node:os';

4import { spawnSync } from 'node:child_process';

cli/mcp/installer.jsView file

Lines 1-21javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import os from 'node:os';

4import { syncAntigravityMcpSchemas } from './antigravity.js';

cli/pillars-wizard.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. st pick = usegum ? gumchoose(choices, 'select architectural pillars configuration') : await promptquestion('select pillars: [1=recommended, 2=strict, 3=custom, 4=minimal, 5=none] (default: 1): '); if (pick && (pick.startswith('2.') || pick === '2')) { selectedpresetkey = 'strict'; selectedpillarids = [...pillar_presets.strict.pillars]; } else if (pick && (pick.startswith('3.') || pick === '3')) { selectedpresetkey = 'custom'; for (const pillar of pillars) { const defaultchoice = pillar_presets.recommended.pillars.includes(pillar.id) ? 'y/n' : 'y/n'; const isdefaultyes = defaultchoice === 'y/n'; const answer = a

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/pillars-wizard.jsView on unpkg

scripts/pre-commit.shView file

•path = scripts/pre-commit.sh kind = build_helper sizeBytes = 5153 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pre-commit.shView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node cli/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node cli/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/errors/errors.spec.jsView file

27patternName = github_pat severity = critical line = 27

Critical

Critical Secret

Package contains a critical-looking secret pattern.

cli/errors/errors.spec.jsView on unpkg · L27

Findings

3 Critical5 High5 Medium5 Low

CriticalCritical Secretcli/errors/errors.spec.js

CriticalAi Agent Control Hijackcli/mcp/installer.js

CriticalSecret Patterncli/errors/errors.spec.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processcli/audit-preflight-git.js

HighShellcli/build/executor.js

HighSame File Env Network Executioncli/license.js

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/pillars-wizard.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/pre-commit.sh

Affected versions and remediation

This report applies to create-chemx@26.9.25-1337.

See all versions of create-chemx for other recorded verdicts.

Review the evidence and your use of create-chemx@26.9.25-1337 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 08:13:45.507Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code