@atlisp/mcp@1.11.4
MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe default-on runtime path executes unverified remote code inside CAD, establishing a concrete remote code execution surface. This supports blocking publication regardless of the package's CAD integration purpose.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A CAD handler connects to CAD while the @lisp core is absent and automatic installation remains enabled.
Impact
Remote service content can execute code in the connected CAD process with the user's permissions.
Mechanism
The bootstrap sends a CAD macro that fetches a response over HTTP and evaluates it inside CAD; initialization fetches and evaluates a response from a second endpoint.
Attack narrative
A CAD handler can trigger the default-on bootstrap after connecting. When the @lisp core is absent, the package sends a macro to CAD that fetches remote AutoLISP over HTTP and evaluates the response directly. The initializer repeats this behavior against a second endpoint, allowing remote code to run in the CAD process.
AI rationale
The default-on runtime path executes unverified remote code inside CAD, establishing a concrete remote code execution surface. This supports blocking publication regardless of the package's CAD integration purpose.
Evidence
dist/atlisp-mcp.js
Network endpoints2
atlisp.cn/@atlisp.cn/cloud
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest exposes dist/atlisp-mcp.js as the package entrypoint.
- Automatic @lisp installation defaults to enabled; wrapped CAD handlers connect before running their requested action, and the connection helper starts installation when enabled.
- If the @lisp core is missing, the bootstrap sends its installer code to CAD.
- The installer fetches code from atlisp.cn over HTTP and evaluates the response; initialization does the same with a second endpoint.
- The bootstrap passes the code directly to CAD's command execution API.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcedist/atlisp-mcp.jsView file
88const raw = fs.readFileSync(filePath, "utf-8");
L89: const parsed = JSON.parse(raw);
L90: const result2 = configSchema.safeParse(parsed);
...
L196: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖
L197: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点，
L198: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。
...
L369: cliArgs = parseArgs();
L370: envResult = envSchema.safeParse(process.env);
L371: if (!envResult.success) {
...
L375: env = envResult.data;
L376: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json");
L377: fileConfig = loadConfigFile(configFilePath);
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/atlisp-mcp.jsView on unpkg · L8888Trigger-reachable chain: manifest.main -> dist/atlisp-mcp.js
L88: const raw = fs.readFileSync(filePath, "utf-8");
L89: const parsed = JSON.parse(raw);
L90: const result2 = configSchema.safeParse(parsed);
...
L196: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖
L197: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点，
L198: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。
...
L369: cliArgs = parseArgs();
L370: envResult = envSchema.safeParse(process.env);
L371: if (!envResult.success) {
...
L375: env = envResult.data;
L376: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json");
L377: fileConfig = loadConfigFile(configFilePath);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
3 Critical5 High6 Medium5 Low
CriticalRemote Asset Decode Executedist/atlisp-mcp.js
CriticalTrigger Reachable Dangerous Capabilitydist/atlisp-mcp.js
CriticalPrevious Version Dangerous Deltadist/atlisp-mcp.js
HighChild Processdist/atlisp-mcp.js
HighShelldist/atlisp-mcp.js
HighCommand Output Exfiltrationdist/atlisp-mcp.js
HighSpawned Bundled Service Listenerdist/atlisp-mcp.js
HighTrigger Reachable Persistencedist/atlisp-mcp.js
MediumDynamic Requiredist/atlisp-mcp.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/atlisp-mcp.js
Medium
Affected versions and remediation
This report applies to @atlisp/mcp@1.11.4.
See all versions of @atlisp/mcp for other recorded verdicts.
- Avoid installing @atlisp/mcp@1.11.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.