registry / AI-agent control-surface risk / @kunlv/atdc
@kunlv/atdc
AI coding workflow orchestration kit — team edition
This report shows the evidence for @kunlv/atdc@1.1.28. 2 of 7 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 15d ago · by lpm-firewall-aiSource confirms an automatic postinstall hook that rewrites MCP registrations for multiple agent clients and creates launchers. This meets the policy for unconsented mutation of foreign or broad AI-agent control surfaces.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package through npm invokes postinstall.
Impact
Agent clients may load and execute this package’s MCP servers without a separate user command to configure them.
Mechanism
The hook creates or rewrites MCP server registrations across Cursor, Claude Code, Codex, and OpenCode configuration files, then writes launchers under ~/.atdc/bin.
Policy narrative
During npm installation, the postinstall routine overwrites MCP registrations in project and user configuration locations and installs package launchers. This is unconsented mutation of broad AI-agent control surfaces, enabling agent clients to execute the package’s servers.
AI rationale
Source confirms an automatic postinstall hook that rewrites MCP registrations for multiple agent clients and creates launchers. This meets the policy for unconsented mutation of foreign or broad AI-agent control surfaces.
Evidence
package.jsonscripts/repair-mcp.jssrc/installers/mcp-registry.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/repair-mcp.js automatically during postinstall.
- The installer targets project MCP configuration and user Cursor, Claude, Codex, and OpenCode configurations.
- The repair routine unconditionally replaces MCP server entries with this package’s launchers.
- The routine writes executable launcher files under ~/.atdc/bin.
Evidence against
- The MCP registration behavior appears designed to connect this package’s own servers to supported coding-agent clients.
- Inspected cookie helper restricts collection to tmeoa.com domains and stores results locally; no unrelated recipient was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
18 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/repair-mcp.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/atdc.jsView file
171try {
L172: const { execSync } = require('child_process');
L173: gitDir = execSync('git rev-parse --git-dir', { encoding: 'utf8' }).trim();
High
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
${result.reportpath}`);
console.log('next: human c2 code review');
}
function cmdhandoff(args) {
const change = args[0] || findactivechange();
if (!change) { console.log('usage: atdc handoff <change-name>'); process.exit(1); }
runscript('handoff-compress.sh', change);
}
function cmdrun(args) {
let mode = 'full';
if (args.includes('--bugfix')) mode = 'bugfix';
else if (args.includes('--hotfix')) mode = 'hotfix';
else if (args.includes('--tweak')) mode = 'tweak';
const { execsync } = require('child_process');
const ts = new date().toisostring().slice(0, 10).replace(/-/g, '');
const changename = `${mode}-${ts}`;
const changedir = `openspec/changes/${chang
Findings
1 Critical16 High4 Medium5 Low
CriticalAi Agent Control Hijacksrc/installers/mcp-registry.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/atdc.js
HighShellsrc/validators/bugfix-finish.js
HighExternal Ai Agent Control Surface Mutationsrc/doctor.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/atdc.js
HighRuntime Package Installsrc/cli/publish.js
HighPayload In Excluded Dirtools/kapi/tests/test_tme_cookie.py
HighSemantic Analysis Limitedsrc/installers/mcp-registry.js#virtual:normalized:round1
HighKnown Malware Source Similaritysrc/cli/publish.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @kunlv/atdc@1.1.28.
The versions list below shows the verdict for each recorded version.
- Avoid installing @kunlv/atdc@1.1.28. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
7 known versions1.1.28latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedOct 8, 2026, 12:14 AM1.1.27MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 6, 2026, 5:30 AM1.1.24SuspiciousAgent extension lifecycle riskWarnPublishedAug 4, 2026, 6:53 AM1.1.6SuspiciousStaged Payload CarrierWarnPublishedJul 20, 2026, 12:59 PM