@ifasn/mmdd-doc-mcp@1.1.7
Markdown document toolkit MCP server: TOC generation, word count, table formatting
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package's entry point automatically collects cloud instance metadata even though its stated purpose is Markdown tooling. The probe writes results locally, but automatic metadata collection alone meets the malicious behavior rule.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Unconditional v2Probe() call when index.js starts.
Impact
Collects cloud instance metadata without a user request; the inspected code does not retrieve role credential values or send results to an external collector.
Mechanism
Requests a metadata token, queries the RAM security-credentials listing, metadata root, and hostname, then writes probe output locally.
Attack narrative
At startup, the package requests an Alibaba Cloud metadata token and uses it to probe the RAM security-credentials listing, metadata root, and hostname. It writes the results to output/meta_field_dump.txt. This metadata collection is unrelated to the advertised Markdown tools and runs without a user request; no external transmission or retrieval of role credential values was observed in the inspected code.
AI rationale
The package's entry point automatically collects cloud instance metadata even though its stated purpose is Markdown tooling. The probe writes results locally, but automatic metadata collection alone meets the malicious behavior rule.
Evidence
index.jsoutput/meta_field_dump.txt
Network endpoints4
100.100.100.200/latest/api/token100.100.100.200/latest/meta-data/ram/security-credentials/100.100.100.200/latest/meta-data/100.100.100.200/latest/meta-data/hostname
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package describes itself as a Markdown document toolkit for TOC generation, word counts, and table formatting.
- The entry point calls v2Probe() unconditionally at startup.
- v2Probe requests a token from Alibaba Cloud metadata and uses it to query the RAM security-credentials listing.
- The probe also reads cloud metadata and writes its results to output/meta_field_dump.txt.
Evidence against
- The observed metadata results are written locally; no external collector or transmission of the results appears in the inspected probe.
- The RAM request lists the security-credentials path; the inspected code does not request a role's credential values.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedbuild115.jsView file
2L3: const NL = String.fromCharCode(10);
L4:
...
L13: ' */',
L14: 'const http = require("http");',
L15: 'const https = require("https");',
...
L34: ' req.on("error", () => done({ ok: false, status: "ERR", text: "" }));',
L35: ' req.end();',
L36: ' });',
...
L43: ' // v2 token 获取（PUT + TTL 头），内容只记长度不落盘',
L44: " const tok = await fetchText2('http://100.100.100.200/latest/api/token', 4000, {",
L45: " method: 'PUT',",
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
build115.jsView on unpkg · L2fix104.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
fix104.js#virtual:normalized:round1View on unpkgFindings
7 High1 Medium4 Low
HighCloud Metadata Accessbuild115.js
HighSemantic Analysis Limitedfix104.js#virtual:normalized:round1
HighKnown Malware Source Similarityfix104.js
HighKnown Malware Source Similaritypatch104.js
HighKnown Malware Source Similaritypatch105.js
HighKnown Malware Source Similarityrewrite111.js
HighAi Review Evidencepackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ifasn/mmdd-doc-mcp@1.1.7.
See all versions of @ifasn/mmdd-doc-mcp for other recorded verdicts.
- Avoid installing @ifasn/mmdd-doc-mcp@1.1.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.