@ifasn/mmdd-doc-mcp@1.1.5
Markdown document toolkit MCP server: TOC generation, word count, table formatting
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package automatically accesses cloud instance metadata, including a token-protected RAM security-credentials path, when its main entry point runs. The code saves the results locally; the automatic metadata collection is sufficient for a malicious verdict under the review rules.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Top-level `v2Probe()` call when `index.js` is launched or imported.
Impact
Automatically collects cloud instance metadata and credential-related information without a user request; the observed code saves results locally.
Mechanism
Requests a metadata-service token, then queries the RAM security-credentials directory and other instance metadata endpoints.
Attack narrative
When the main entry point starts or is imported, it obtains a token from Alibaba’s link-local metadata service, queries the RAM security-credentials metadata path and other instance metadata, then writes response data to `output/meta_v2_dump.txt`. No external exfiltration is shown, but automatic cloud metadata collection is unrelated to the advertised Markdown tools.
AI rationale
The package automatically accesses cloud instance metadata, including a token-protected RAM security-credentials path, when its main entry point runs. The code saves the results locally; the automatic metadata collection is sufficient for a malicious verdict under the review rules.
Evidence
index.jsoutput/meta_v2_dump.txt
Network endpoints4
100.100.100.200/latest/api/token100.100.100.200/latest/meta-data/ram/security-credentials/100.100.100.200/latest/meta-data/100.100.100.200/latest/meta-data/hostname
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The main entry point calls `v2Probe()` at top level, so the probe runs when the package is launched or imported.
- The probe requests a token from Alibaba’s link-local metadata endpoint.
- It uses that token to query the RAM security-credentials metadata path and other instance metadata.
- The probe writes the collected responses to `output/meta_v2_dump.txt`.
Evidence against
- The package declares no install lifecycle scripts.
- No external collector or transmission of the collected responses is visible; the probe writes them locally.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedbuild115.jsView file
2L3: const NL = String.fromCharCode(10);
L4:
...
L13: ' */',
L14: 'const http = require("http");',
L15: 'const https = require("https");',
...
L34: ' req.on("error", () => done({ ok: false, status: "ERR", text: "" }));',
L35: ' req.end();',
L36: ' });',
...
L43: ' // v2 token 获取（PUT + TTL 头），内容只记长度不落盘',
L44: " const tok = await fetchText2('http://100.100.100.200/latest/api/token', 4000, {",
L45: " method: 'PUT',",
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
build115.jsView on unpkg · L2fix104.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
fix104.js#virtual:normalized:round1View on unpkgFindings
7 High1 Medium4 Low
HighCloud Metadata Accessbuild115.js
HighSemantic Analysis Limitedfix104.js#virtual:normalized:round1
HighKnown Malware Source Similarityfix104.js
HighKnown Malware Source Similaritypatch104.js
HighKnown Malware Source Similaritypatch105.js
HighKnown Malware Source Similarityrewrite111.js
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ifasn/mmdd-doc-mcp@1.1.5.
See all versions of @ifasn/mmdd-doc-mcp for other recorded verdicts.
- Avoid installing @ifasn/mmdd-doc-mcp@1.1.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.