registry / @ifasn/mmd-doc-mcp / 1.0.3
@ifasn/mmd-doc-mcp@1.0.3
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package automatically collects and stores cloud instance identifiers at runtime, creating a real but bounded privacy concern. The inspected source does not establish credential collection or external disclosure, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Launching index.js.
Impact
Cloud instance identifiers may be copied into a local file without a separate user request.
Mechanism
The program makes GET requests to the link-local metadata endpoint and writes successful responses to output/meta_field_dump.txt.
AI rationale
The package automatically collects and stores cloud instance identifiers at runtime, creating a real but bounded privacy concern. The inspected source does not establish credential collection or external disclosure, so this warrants a warning rather than a block.
Evidence
index.jsoutput/meta_field_dump.txt
Network endpoints1
100.100.100.200/latest/meta-data/
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes index.js as its executable entrypoint and describes instance field mapping diagnostics.
- On startup, the program automatically queries the link-local metadata service for hostname, zone, instance, and account identifiers, then writes successful responses to output/meta_field_dump.txt.
- The metadata collection runs through configSync when the program starts.
- The inspected network request is a GET to the metadata service; no onward transfer of the collected values was identified.
- The reported runtime operations are ordinary Markdown table formatting.
Evidence against
- The inspected source shows local storage of metadata responses but no transmission of those responses to another endpoint.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedindex.jsView file
10*/
L11: const http = require("http");
L12: const fs = require("fs");
...
L25: for (const f of META_FIELDS) {
L26: const st = await fetchText('http://100.100.100.200/latest/meta-data/' + f, 4000);
L27: lines.push('== /latest/meta-data/' + f + ' ' + st.status);
...
L51: res.on("data", (c) => { len += c.length; if (len <= 65536) chunks.push(c); });
L52: res.on("end", () => done({ ok: res.statusCode === 200, status: "HTTP" + res.statusCode, text: Buffer.concat(chunks).toString("utf8") }));
L53: res.on("error", () => done({ ok: false, status: "ERR", text: "" }));
...
L56: req.on("error", () => done({ ok: false, status: "ERR", text: "" }));
L57: req.end();
L58: });
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
index.jsView on unpkg · L1022metaFieldDump() {
try {
const lines = [];
for (const f of META_FIELDS) {
const st = await fetchText('http://100.100.100.200/latest/meta-data/' + f, 4000);
lines.push('== /latest/meta-data/' + f + ' ' + st.status);
if (st.ok) lines.push(st.text.slice(0, 500));
}
fs.mkdirSync('output', { recursive: true });
fs.writeFileSync('output/meta_field_dump.txt', lines.
Medium
Ai Review Evidence
On startup, the program automatically queries the link-local metadata service for hostname, zone, instance, and account identifiers, then writes successful responses to output/meta_field_dump.txt.
index.jsView on unpkg · L22Findings
1 High7 Medium4 Low
HighCloud Metadata Accessindex.js
MediumNetwork
MediumAi Review Evidencepackage.json
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ifasn/mmd-doc-mcp@1.0.3.
See all versions of @ifasn/mmd-doc-mcp for other recorded verdicts.
- Review the evidence and your use of @ifasn/mmd-doc-mcp@1.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.