registry / Data exfiltration / @atlisp/mcp / 1.9.5

@atlisp/mcp@1.9.5

MCP Server for @lisp on CAD,support AutoCAD/GstarCAD/ZWCAD/BricsCAD or CAD platform compatible with AutoLISP

AI Security Review

scanned 23h ago · by lpm-firewall-ai

Source inspection confirms automatic recurring disclosure of host-identifying health data, so this warrants a warning for data exfiltration. The package-aligned endpoint and operational payload do not establish a publish-block attack.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Starting the MCP server.

Impact

The package service receives identifying host and usage health information without an evident consent setting in this path.

Mechanism

The health reporter gathers the machine hostname and CAD/runtime status, posts them to the fixed endpoint, then repeats on a timer.

AI rationale

Evidence

package.jsondist/atlisp-mcp.js

Network endpoints1

atlisp.cn/api/mcp/health

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package entrypoint starts a health reporter after the server starts.
The report includes the machine hostname and CAD and runtime status.
The running process sends the report to a fixed package-service endpoint on a repeating interval.
Autostart changes are behind explicit CLI flags.

Evidence against

The reported fields are operational health metrics; the inspected code does not show credentials or user document contents being sent.
The collector is the package’s own service, and the autostart mutation requires an explicit command-line flag.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 1.47 MB of source, external domains: 127.0.0.1, api.openai.com, atlisp.cn, example.com, raw.githubusercontent.com, s3.atlisp.cn, www.apple.com

Source & flagged code

9 flagged

dist/atlisp-mcp.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @atlisp/mcp@1.9.2 matchedIdentity = npm:QGF0bGlzcC9tY3A:1.9.2 similarity = 0.952 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

1132}); L1133: import { spawn } from "child_process"; L1134: import path4 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L1132

22923const baseCmd = getStartupCommand(); L22924: const psCmd = `powershell -WindowStyle Hidden -Command "${baseCmd}"`; L22925: try {

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L22923

87const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/atlisp-mcp.jsView on unpkg · L87

87Detached bundled service listener: dist/atlisp-mcp.js launches a Node helper and exposes a broad-bound HTTP listener. L87: const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/atlisp-mcp.jsView on unpkg · L87

87Trigger-reachable persistence chain: manifest.main -> dist/atlisp-mcp.js L87: const raw = fs.readFileSync(filePath, "utf-8"); L88: const parsed = JSON.parse(raw); L89: const result = configSchema.safeParse(parsed); ... L177: ENABLE_CORS: z.coerce.boolean().optional().default(true), L178: CORS_ORIGIN: z.string().optional().default("https://atlisp.cn"), L179: RATE_LIMIT_WINDOW: z.coerce.number().optional().default(6e4), ... L290: cliArgs = parseArgs(); L291: envResult = envSchema.safeParse(process.env); L292: if (!envResult.success) { ... L296: env = envResult.data; L297: configFilePath = env.CONFIG_FILE || cliArgs.configFile || path.join(os.homedir(), ".atlisp", "atlisp.config.json"); L298: fileConfig = loadConfigFile(configFilePath);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/atlisp-mcp.jsView on unpkg · L87

972try { L973: const { NodeTracerProvider, BatchSpanProcessor } = await import("@opentelemetry/sdk-trace-node"); L974: const { OTLPTraceExporter } = await import("@opentelemetry/exporter-trace-otlp-http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/atlisp-mcp.jsView on unpkg · L972

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/atlisp-mcp.jsView on unpkg · L87

dist/cad-rothelper.dllView file

•path = dist/cad-rothelper.dll kind = native_binary sizeBytes = 22016 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/cad-rothelper.dllView on unpkg

Source & flagged code

9 flagged · loading source

dist/atlisp-mcp.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/atlisp-mcp.jsView on unpkg

1132}); L1133: import { spawn } from "child_process"; L1134: import path4 from "path";

High

Child Process

Package source references child process execution.

dist/atlisp-mcp.jsView on unpkg · L1132

22923const baseCmd = getStartupCommand(); L22924: const psCmd = `powershell -WindowStyle Hidden -Command "${baseCmd}"`; L22925: try {

High

Shell

Package source references shell execution.

dist/atlisp-mcp.jsView on unpkg · L22923

Findings

1 Critical5 High6 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/atlisp-mcp.js

HighChild Processdist/atlisp-mcp.js

HighShelldist/atlisp-mcp.js

HighCommand Output Exfiltrationdist/atlisp-mcp.js

HighSpawned Bundled Service Listenerdist/atlisp-mcp.js

HighTrigger Reachable Persistencedist/atlisp-mcp.js

MediumDynamic Requiredist/atlisp-mcp.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/atlisp-mcp.js

MediumShips Native Binarydist/cad-rothelper.dll

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

Affected versions and remediation

This report applies to @atlisp/mcp@1.9.5.

See all versions of @atlisp/mcp for other recorded verdicts.

Review the evidence and your use of @atlisp/mcp@1.9.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 02:52:45.883Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.