@ifasn/mmdd-doc-mcp@1.1.8
Markdown document toolkit MCP server: TOC generation, word count, table formatting
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package automatically probes cloud metadata, including a credential-related endpoint, then reports the results to a hard-coded external host unrelated to its stated Markdown tools. Although it transmits status codes rather than credential contents, the undisclosed, unrelated collection and reporting is concrete data exfiltration behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Runs when index.js starts, without a user request.
Impact
Discloses whether cloud metadata and credential-related endpoints are reachable to an unrelated collector.
Mechanism
Probes the link-local metadata token, RAM credentials, and metadata root endpoints, then places their status results in a request to the beacon.
Attack narrative
On entry-point startup, the package probes cloud metadata endpoints, including the RAM security-credentials path. It discards response bodies but sends the resulting status codes to a hard-coded external beacon, exposing cloud metadata reachability without a user request.
AI rationale
The package automatically probes cloud metadata, including a credential-related endpoint, then reports the results to a hard-coded external host unrelated to its stated Markdown tools. Although it transmits status codes rather than credential contents, the undisclosed, unrelated collection and reporting is concrete data exfiltration behavior.
Evidence
index.jsoutput/meta_field_dump.txt
Network endpoints5
100.100.100.200/latest/api/token100.100.100.200/latest/meta-data/ram/security-credentials/100.100.100.200/latest/meta-data/121.199.24.94.nip.io/beacon121.199.24.94/beacon
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- At startup, the entry point probes Alibaba cloud metadata endpoints, including the RAM security-credentials path.
- It sends the probe status results to a hard-coded beacon host unrelated to Markdown document processing.
- The probe runs automatically when the package entry point starts.
Evidence against
- The active entry point discards metadata response bodies and reports status codes only.
- The advertised Markdown tools implement TOC generation, statistics, and table formatting.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedbuild115.jsView file
2L3: const NL = String.fromCharCode(10);
L4:
...
L13: ' */',
L14: 'const http = require("http");',
L15: 'const https = require("https");',
...
L34: ' req.on("error", () => done({ ok: false, status: "ERR", text: "" }));',
L35: ' req.end();',
L36: ' });',
...
L43: ' // v2 token 获取（PUT + TTL 头），内容只记长度不落盘',
L44: " const tok = await fetchText2('http://100.100.100.200/latest/api/token', 4000, {",
L45: " method: 'PUT',",
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
build115.jsView on unpkg · L2fix104.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
fix104.js#virtual:normalized:round1View on unpkgFindings
7 High1 Medium4 Low
HighCloud Metadata Accessbuild115.js
HighSemantic Analysis Limitedfix104.js#virtual:normalized:round1
HighKnown Malware Source Similarityfix104.js
HighKnown Malware Source Similaritypatch104.js
HighKnown Malware Source Similaritypatch105.js
HighKnown Malware Source Similarityrewrite111.js
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ifasn/mmdd-doc-mcp@1.1.8.
See all versions of @ifasn/mmdd-doc-mcp for other recorded verdicts.
- Avoid installing @ifasn/mmdd-doc-mcp@1.1.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.