Loading npm security reports…

@kunlv/atdc@1.1.27: AI-agent control-surface risk | LPM Firewall

registry / @kunlv/atdc / 1.1.27

@kunlv/atdc@1.1.27

AI coding workflow orchestration kit — team edition

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently registers package MCP launchers across multiple AI-agent products. Launching those MCP servers automatically runs doctor, which performs additional configuration and hook mutations.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install of @kunlv/atdc@1.1.27; later MCP session startup.

Impact

Package gains persistent execution through Cursor, Claude, Codex, and OpenCode MCP configuration; later doctor path can alter hooks and shell configuration.

Mechanism

unconsented postinstall AI-agent MCP registration and auto-repair chain

Policy narrative

Installation invokes repair-mcp.js without user action. It creates stable launchers under ~/.atdc and inserts atdc MCP entries into Cursor, Claude, Codex, and OpenCode configurations. Those entries load package-controlled code at future agent session startup; atdc-server then spawns doctor automatically, which performs further agent-control and configuration repairs. This is an unconsented install-time mutation of foreign, broad AI-agent control surfaces.

Rationale

Source confirms concrete postinstall persistence across unrelated AI-agent configurations, meeting block policy. Network and cookie primitives do not reduce this independent install-time control-surface risk.

Evidence

package.jsonscripts/repair-mcp.jssrc/installers/mcp-registry.jssrc/mcp/atdc-server.jssrc/doctor.jsAGENTS.mdtools/kapi/tme_cookie.py~/.atdc/package-root

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/repair-mcp.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/atdc.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kunlv/atdc@1.1.24 matchedIdentity = npm:QGt1bmx2L2F0ZGM:1.1.24 similarity = 0.386 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/atdc.jsView on unpkg

162try { L163: const { execSync } = require('child_process'); L164: gitDir = execSync('git rev-parse --git-dir', { encoding: 'utf8' }).trim();

High

Child Process

Package source references child process execution.

bin/atdc.jsView on unpkg · L162

tools/kapi/kapi-cdp-cookie.jsView file

2L3: const puppeteer = require("puppeteer"); L4: const fs = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/kapi/kapi-cdp-cookie.jsView on unpkg · L2

src/doctor.jsView file

9Trigger-reachable persistence chain: manifest.bin -> bin/atdc.js -> src/doctor.js L9: const os = require('os'); L10: const { execSync } = require('child_process'); L11: L12: const HOME = os.homedir(); L13: const OPENCODE_CONFIG = path.join(HOME, '.config', 'opencode', 'opencode.json'); ... L54: if (!fs.existsSync(filePath)) return null; L55: try { return JSON.parse(fs.readFileSync(filePath, 'utf8')); } catch { return null; } L56: } ... L77: const dir = fs.existsSync(CONTEXT_MODE_GLOBAL) ? CONTEXT_MODE_GLOBAL : CONTEXT_MODE_DIR; L78: if (!fs.existsSync(path.join(dir, 'package.json'))) return false; L79: try { ... L237: const rtkCmOk = cursor.hasAtdcRtkCmHooks(cfg);

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/doctor.jsView on unpkg · L9

9const os = require('os'); L10: const { execSync } = require('child_process'); L11: L12: const HOME = os.homedir(); L13: const OPENCODE_CONFIG = path.join(HOME, '.config', 'opencode', 'opencode.json'); ... L54: if (!fs.existsSync(filePath)) return null; L55: try { return JSON.parse(fs.readFileSync(filePath, 'utf8')); } catch { return null; } L56: } ... L77: const dir = fs.existsSync(CONTEXT_MODE_GLOBAL) ? CONTEXT_MODE_GLOBAL : CONTEXT_MODE_DIR; L78: if (!fs.existsSync(path.join(dir, 'package.json'))) return false; L79: try { ... L237: const rtkCmOk = cursor.hasAtdcRtkCmHooks(cfg);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/doctor.jsView on unpkg · L9

src/installers/mcp-registry.jsView file

27Install-time code directly mutates a foreign AI-agent control surface: L59: function ensureStateDir() { L60: if (!exists(ATDC_STATE_DIR)) fs.mkdirSync(ATDC_STATE_DIR, { recursive: true }); L61: if (!exists(STABLE_BIN_DIR)) fs.mkdirSync(STABLE_BIN_DIR, { recursive: true }); L62: } ... L69: } L70: fs.writeFileSync(PACKAGE_ROOT_FILE, pkgDir + '\n', 'utf8'); L71: return pkgDir; ... L84: writePackageRoot(); L85: fs.writeFileSync(STABLE_MCP_LAUNCHER, LAUNCHER_MCP_SRC, { mode: 0o755 }); L86: fs.writeFileSync(STABLE_HEALTH_LAUNCHER, LAUNCHER_HEALTH_SRC, { mode: 0o755 }); L87: try { fs.chmodSync(STABLE_MCP_LAUNCHER, 0o755); } catch {} ... L160: const dir = path.dirname(filePath); Write operation from src/installers/mcp-registry.js: L59: function ensureStateDir() { L60: if (!exists(ATDC_STATE_DIR))

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/installers/mcp-registry.jsView on unpkg · L27

src/cli/publish.jsView file

118try { L119: execSync(`npm install -g ${pkgPath}`, { stdio: 'inherit', cwd: safeCwd }); L120: console.log(` ✓ v${newVer} 已安装（本地路径，无需等待 CDN）\n`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/cli/publish.jsView on unpkg · L118

tools/note-sync/note-link.pyView file

•path = tools/note-sync/note-link.py kind = build_helper sizeBytes = 7852 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/note-sync/note-link.pyView on unpkg

tools/kapi/tests/test_tme_cookie.pyView file

•path = tools/kapi/tests/test_tme_cookie.py kind = payload_in_excluded_dir sizeBytes = 3342 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tools/kapi/tests/test_tme_cookie.pyView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 9-49json

9 "atdc-evidence-mcp": "src/mcp/evidence-server.js"

10 },

11 "files": [

12 "bin/",

13 "src/",

14 "hooks/",

15 "prompts/",

16 "tools/",

17 "templates/",

18 "central/",

19 "scripts/",

20 "config/",

21 "cursor/",

22 "GO.md",

23 "install.sh",

24 "commands/",

25 "AGENTS.md",

26 "reference/"

27 ],

28 "scripts": {

29 "postinstall": "node scripts/repair-mcp.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

30 "prepublishOnly": "npm run test:mcp && node scripts/repair-mcp.js",

31 "repair-mcp": "node scripts/repair-mcp.js",

32 "test:mcp": "node src/artifact-store.test.js && node src/workflow-state.test.js && node src/change-resolve.test.js && node src/cli-change-targeting.test.js && node src/audit/analyzer.test.js && node src/audit/index.test.js && node src/audit/renderer.test.js && node src/validators/gate-check.test.js && node src/validators/r4-boundary.test.js && node src/validators/r6-sql.test.js && node src/validators/r8-git.test.js && node src/validators/rule-cards.test.js && node src/validators/mode-cards.test.js && node src/validators/preflight.test.js && node src/validators/preflight-apply.test.js && no ...

33 "sync:hot-path": "node bin/sync-hot-path.js",

34 "check:hot-path": "node bin/sync-hot-path.js --check"

35 },

36 "keywords": [

37 "ai",

38 "workflow",

39 "coding",

40 "spec-driven"

41 ],

42 "license": "MIT",

43 "engines": {

44 "node": ">=16"

45 },

46 "dependencies": {

47 "puppeteer": "^25.3.0",

48 "@kunlv/cls-log-cli": "^1.2.9"

49 }

Long lines were clipped for display.

bin/atdc.jsView file

Lines 142-182javascript

142 const cfg = TERMINAL_CONFIGS[t];

143 console.log(`\n${cfg.name}:`);

144 const r = installers[t].

tools/kapi/kapi-cdp-cookie.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3const puppeteer = require("puppeteer");

4const fs = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/doctor.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2'use strict';

3

4// doctor.js — Health check + auto-repair for token optimization tools

5// Checks: context-mode build, rtk plugin, MCP servers, native ABI, config integrity

6

7const fs = require('fs');

8const path

src/installers/mcp-registry.jsView file

Lines 7-47javascript

7 * 1. Maintain stable launchers under ~/.atdc/bin/ (path never changes in mcp.json)

8 * 2. ~/.atdc/package-root points at current package tree (rewritten on install/

src/cli/publish.jsView file

Lines 98-129javascript

98 return;

99 }

100 }

101

102 // ── Publish ──

103 console.log('\n[publish] npm publish...');

104 const env =

tools/note-sync/note-link.pyView file

•path = tools/note-sync/note-link.py kind = build_helper sizeBytes = 7852 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/note-sync/note-link.pyView on unpkg

tools/kapi/tests/test_tme_cookie.pyView file

•path = tools/kapi/tests/test_tme_cookie.py kind = payload_in_excluded_dir sizeBytes = 3342 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tools/kapi/tests/test_tme_cookie.pyView on unpkg