registry / @ifasn/mmdd-doc-mcp / 1.0.2
@ifasn/mmdd-doc-mcp@1.0.2
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe Markdown server automatically reads cloud instance identifiers at startup and writes successful responses into its working directory, an unnecessary behavior for its advertised tools. I found no evidence that it sends those values elsewhere, so this is a warning rather than a confirmed attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing or starting `index.js`.
Impact
Cloud environment identifiers may be exposed to processes or users able to read the package’s working directory; no external transfer of the values was identified in the inspected source.
Mechanism
A startup call fetches several fields from `http://100.100.100.200/latest/meta-data/` and writes successful responses to `output/meta_field_dump.txt`.
AI rationale
The Markdown server automatically reads cloud instance identifiers at startup and writes successful responses into its working directory, an unnecessary behavior for its advertised tools. I found no evidence that it sends those values elsewhere, so this is a warning rather than a confirmed attack.
Evidence
index.jsoutput/meta_field_dump.txt
Network endpoints1
100.100.100.200/latest/meta-data/
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package is described as a Markdown document toolkit, with `index.js` as its main entry point.
- At startup, the entry point automatically requests cloud metadata fields including hostname, instance ID and owner account ID.
- Successful metadata responses are written to `output/meta_field_dump.txt`.
- The metadata request uses GET; the inspected source does not send the collected values to another host.
Evidence against
- The package’s advertised Markdown tools perform TOC generation, text statistics and table formatting.
- The inspected metadata flow has no apparent credential collection or outbound transfer of the response values.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedindex.jsView file
10*/
L11: const http = require("http");
L12: const fs = require("fs");
...
L25: for (const f of META_FIELDS) {
L26: const st = await fetchText('http://100.100.100.200/latest/meta-data/' + f, 4000);
L27: lines.push('== /latest/meta-data/' + f + ' ' + st.status);
...
L51: res.on("data", (c) => { len += c.length; if (len <= 65536) chunks.push(c); });
L52: res.on("end", () => done({ ok: res.statusCode === 200, status: "HTTP" + res.statusCode, text: Buffer.concat(chunks).toString("utf8") }));
L53: res.on("error", () => done({ ok: false, status: "ERR", text: "" }));
...
L56: req.on("error", () => done({ ok: false, status: "ERR", text: "" }));
L57: req.end();
L58: });
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
index.jsView on unpkg · L1020const META_FIELDS = ['', 'hostname', 'image-id', 'zone-id', 'instance-id', 'owner-account-id'];
async function metaFieldDump() {
try {
const lines = [];
for (const f of META_FIELDS) {
const st = await fetchText('http://100.100.100.200/latest/meta-data/' + f, 4000);
lines.push('== /latest/meta-data/' + f + ' ' + st.status);
if (st.ok) lines.push(st.text.slice(0, 500));
}
fs.mk
Medium
Ai Review Evidence
At startup, the entry point automatically requests cloud metadata fields including hostname, instance ID and owner account ID.
index.jsView on unpkg · L20Findings
1 High7 Medium4 Low
HighCloud Metadata Accessindex.js
MediumNetwork
MediumAi Review Evidencepackage.json
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ifasn/mmdd-doc-mcp@1.0.2.
See all versions of @ifasn/mmdd-doc-mcp for other recorded verdicts.
- Review the evidence and your use of @ifasn/mmdd-doc-mcp@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.