@atlisp/mcp@1.11.8

⚠ Under review

MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The scanner's remote decode-and-execute hint was not supported by the inspected skill path: an explicit skill_install call fetches text and writes a Markdown file. The unresolved edge-js dependency and unverified tray executable leave material runtime behavior unassessed, so manual review is appropriate.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Using the package runtime or launching the tray command.

Impact

Potential behavior from these components cannot be assessed from the available source.

Mechanism

The runtime depends on edge-js, and the tray entrypoint starts the packaged Windows executable; their behavior is not established by the inspected source.

AI rationale

Evidence

package.jsondist/atlisp-mcp.jstray/atlisp-tray.js

Decision evidence

public snapshot

AI called this Manual Review at 86.0% confidence as Unknown with medium false-positive risk.

AI review observations

package.json defines prepublishOnly as a build check and declares edge-js as a runtime dependency; the inspected source for that dependency was unresolved.
The tray launcher starts a packaged Windows executable whose behavior was not verified from source.
The remote skill download is saved as Markdown under the package's .atlisp/skills directory through the skill_install feature; inspected code did not show it decoding or executing the download.

Evidence against

The manifest shows no preinstall, install, or postinstall hook; prepublishOnly does not run as a registry install hook.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 59 file(s), 1.77 MB of source, external domains: 127.0.0.1, api.openai.com, atlisp.cn, example.com, raw.githubusercontent.com, s3.atlisp.cn, www.apple.com

Source & flagged code

14 flagged

dist/atlisp-mcp.jsView file

88const raw = fs.readFileSync(filePath, "utf-8"); L89: const parsed = JSON.parse(raw); L90: const result2 = configSchema.safeParse(parsed); ... L196: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L197: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L198: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L369: cliArgs = parseArgs(); L370: envResult = envSchema.safeParse(process.env); L371: if (!envResult.success) { ... L375: env = envResult.data; L376: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L377: fileConfig = loadConfigFile(configFilePath);

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/atlisp-mcp.jsView on unpkg · L88

88Trigger-reachable chain: manifest.main -> dist/atlisp-mcp.js L88: const raw = fs.readFileSync(filePath, "utf-8"); L89: const parsed = JSON.parse(raw); L90: const result2 = configSchema.safeParse(parsed); ... L196: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L197: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L198: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L369: cliArgs = parseArgs(); L370: envResult = envSchema.safeParse(process.env); L371: if (!envResult.success) { ... L375: env = envResult.data; L376: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L377: fileConfig = loadConfigFile(configFilePath);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/atlisp-mcp.jsView on unpkg · L88

•matchType = previous_version_dangerous_delta matchedPackage = @atlisp/mcp@1.11.3 matchedIdentity = npm:QGF0bGlzcC9tY3A:1.11.3 similarity = 0.931 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

6928}); L6929: import { spawn } from "child_process"; L6930: import path5 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L6928

28025const base = `& '${process.execPath}' '${process.argv[1]}' --transport http`; L28026: return `powershell -WindowStyle Hidden -Command "${base}"`; L28027: }

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L28025

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/atlisp-mcp.jsView on unpkg · L88

88Detached bundled service listener: dist/atlisp-mcp.js launches a Node helper and exposes a broad-bound HTTP listener. L88: const raw = fs.readFileSync(filePath, "utf-8"); L89: const parsed = JSON.parse(raw); L90: const result2 = configSchema.safeParse(parsed); ... L196: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L197: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L198: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L369: cliArgs = parseArgs(); L370: envResult = envSchema.safeParse(process.env); L371: if (!envResult.success) { ... L375: env = envResult.data; L376: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L377: fileConfig = loadConfigFile(configFilePath);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/atlisp-mcp.jsView on unpkg · L88

88Trigger-reachable persistence chain: manifest.main -> dist/atlisp-mcp.js L88: const raw = fs.readFileSync(filePath, "utf-8"); L89: const parsed = JSON.parse(raw); L90: const result2 = configSchema.safeParse(parsed); ... L196: // 会先剥掉 scheme 与端口再比较（getHost）。所以 `localhost` 这条已经覆盖 L197: // http://localhost:8100 / :8110 等本机所有端口；加了 https:// 反而看不出这一点， L198: // 容易被后人「修正」成逐个端口枚举。* 开头按子域后缀匹配。 ... L369: cliArgs = parseArgs(); L370: envResult = envSchema.safeParse(process.env); L371: if (!envResult.success) { ... L375: env = envResult.data; L376: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L377: fileConfig = loadConfigFile(configFilePath);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/atlisp-mcp.jsView on unpkg · L88

•matchType = normalized_sha256 matchedPackage = @atlisp/mcp@1.11.4 matchedPath = dist/atlisp-mcp.js matchedIdentity = npm:QGF0bGlzcC9tY3A:1.11.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

1124try { L1125: const { NodeTracerProvider, BatchSpanProcessor } = await import("@opentelemetry/sdk-trace-node"); L1126: const { OTLPTraceExporter } = await import("@opentelemetry/exporter-trace-otlp-http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/atlisp-mcp.jsView on unpkg · L1124

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/atlisp-mcp.jsView on unpkg · L88

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/atlisp-mcp.jsView on unpkg · L88

dist/AtlispTray.exeView file

•path = dist/AtlispTray.exe kind = native_binary sizeBytes = 126976 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/AtlispTray.exeView on unpkg

tray/atlisp-tray.jsView file

•matchType = normalized_sha256 matchedPackage = @atlisp/mcp@1.11.4 matchedPath = tray/atlisp-tray.js matchedIdentity = npm:QGF0bGlzcC9tY3A:1.11.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tray/atlisp-tray.jsView on unpkg

Source & flagged code

14 flagged · loading source

dist/atlisp-mcp.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/atlisp-mcp.jsView on unpkg · L88

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Findings

3 Critical7 High6 Medium6 Low

CriticalRemote Asset Decode Executedist/atlisp-mcp.js

CriticalTrigger Reachable Dangerous Capabilitydist/atlisp-mcp.js

CriticalPrevious Version Dangerous Deltadist/atlisp-mcp.js

HighChild Processdist/atlisp-mcp.js

HighShelldist/atlisp-mcp.js

HighCommand Output Exfiltrationdist/atlisp-mcp.js

HighSpawned Bundled Service Listenerdist/atlisp-mcp.js

HighTrigger Reachable Persistencedist/atlisp-mcp.js

HighKnown Malware Source Similaritydist/atlisp-mcp.js

HighKnown Malware Source Similaritytray/atlisp-tray.js

MediumDynamic Requiredist/atlisp-mcp.js

Medium

Affected versions and remediation

This report applies to @atlisp/mcp@1.11.8.

See all versions of @atlisp/mcp for other recorded verdicts.

Review the evidence and your use of @atlisp/mcp@1.11.8 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 09:58:29.035Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.