registry / @atlisp/mcp / 1.11.5
@atlisp/mcp@1.11.5
⚠ Under reviewMCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe inspected source did not establish the flagged remote payload execution behavior. However, edge-js is a selected runtime dependency imported by the CAD worker, and its source remained unresolved, so the package requires manual review.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Use of the CAD worker, which imports edge-js.
Impact
The dependency's behavior cannot be assessed from this inspection, so a clean verdict is not supported.
Mechanism
The worker delegates CAD integration to edge-js and a packaged helper DLL; the dependency source was unavailable for verification.
AI rationale
The inspected source did not establish the flagged remote payload execution behavior. However, edge-js is a selected runtime dependency imported by the CAD worker, and its source remained unresolved, so the package requires manual review.
Evidence
package.jsondist/cad-worker.js
Decision evidence
public snapshotAI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json declares edge-js as a runtime dependency.
- dist/cad-worker.js imports edge-js; the dependency source was unresolved in the available inspection, so its behavior could not be verified.
- The bundled entrypoint starts the server when imported outside the test environment.
Evidence against
- package.json defines no install, preinstall, or postinstall lifecycle hook.
- The inspected skill installation path is a user-invoked API that writes downloaded text as a Markdown file; no execution of that content was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
15 flagged · loading sourcedist/atlisp-mcp.jsView file
88const raw = fs.readFileSync(filePath, "utf-8");
L89: const parsed = JSON.parse(raw);
L90: const result2 = configSchema.safeParse(parsed);
...
L196: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖
L197: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点，
L198: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。
...
L369: cliArgs = parseArgs();
L370: envResult = envSchema.safeParse(process.env);
L371: if (!envResult.success) {
...
L375: env = envResult.data;
L376: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json");
L377: fileConfig = loadConfigFile(configFilePath);
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/atlisp-mcp.jsView on unpkg · L8888Trigger-reachable chain: manifest.main -> dist/atlisp-mcp.js
L88: const raw = fs.readFileSync(filePath, "utf-8");
L89: const parsed = JSON.parse(raw);
L90: const result2 = configSchema.safeParse(parsed);
...
L196: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖
L197: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点，
L198: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。
...
L369: cliArgs = parseArgs();
L370: envResult = envSchema.safeParse(process.env);
L371: if (!envResult.success) {
...
L375: env = envResult.data;
L376: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json");
L377: fileConfig = loadConfigFile(configFilePath);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
3 Critical8 High6 Medium5 Low
CriticalRemote Asset Decode Executedist/atlisp-mcp.js
CriticalTrigger Reachable Dangerous Capabilitydist/atlisp-mcp.js
CriticalPrevious Version Dangerous Deltadist/atlisp-mcp.js
HighChild Processdist/atlisp-mcp.js
HighShelldist/atlisp-mcp.js
HighCommand Output Exfiltrationdist/atlisp-mcp.js
HighSpawned Bundled Service Listenerdist/atlisp-mcp.js
HighTrigger Reachable Persistencedist/atlisp-mcp.js
HighKnown Malware Source Similaritydist/atlisp-mcp.js
HighKnown Malware Source Similaritytray/atlisp-tray.js
HighKnown Malware Source Fingerprint Signaturedist/atlisp-mcp.js
Affected versions and remediation
This report applies to @atlisp/mcp@1.11.5.
See all versions of @atlisp/mcp for other recorded verdicts.
- Review the evidence and your use of @atlisp/mcp@1.11.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.