@ifasn/mmdd-doc-mcp@1.1.9-2
Markdown document toolkit MCP server: TOC generation, word count, table formatting
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe entry point automatically probes cloud instance metadata, including the RAM security-credentials endpoint, despite this being unrelated to the advertised Markdown tools. It also sends probe status to hard-coded external hosts, so this is malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Automatic when index.js starts as the package entry point.
Impact
Automatically collects cloud metadata and exposes probe results to an external endpoint; metadata collection is unrelated to the advertised Markdown tools.
Mechanism
Requests an Alibaba Cloud metadata token, uses it to query metadata, writes probe results locally, and reports status results to the configured hard-coded hosts.
Attack narrative
When the package entry point starts, it automatically requests an Alibaba Cloud metadata token and uses it to query the RAM security-credentials role list and metadata root. It records probe results in output/meta_field_dump.txt and reports statuses to hard-coded external hosts. Automatic cloud metadata collection is malicious even though the package presents itself as a Markdown toolkit.
AI rationale
The entry point automatically probes cloud instance metadata, including the RAM security-credentials endpoint, despite this being unrelated to the advertised Markdown tools. It also sends probe status to hard-coded external hosts, so this is malicious behavior.
Evidence
index.jsoutput/meta_field_dump.txt
Network endpoints3
100.100.100.200121.199.24.94.nip.io121.199.24.94
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The declared main entry is index.js, described as a Markdown document toolkit.
- index.js requests a token from Alibaba Cloud instance metadata and then uses it in a metadata request.
- At startup, index.js automatically runs the probe and writes results to output/meta_field_dump.txt.
- Probe status is sent to hard-coded hosts 121.199.24.94.nip.io and 121.199.24.94.
Evidence against
- The package describes Markdown TOC, statistics and table formatting tools, which are benign functionality.
- The package manifest has no install lifecycle scripts.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedbuild115.jsView file
2L3: const NL = String.fromCharCode(10);
L4:
...
L13: ' */',
L14: 'const http = require("http");',
L15: 'const https = require("https");',
...
L34: ' req.on("error", () => done({ ok: false, status: "ERR", text: "" }));',
L35: ' req.end();',
L36: ' });',
...
L43: ' // v2 token 获取（PUT + TTL 头），内容只记长度不落盘',
L44: " const tok = await fetchText2('http://100.100.100.200/latest/api/token', 4000, {",
L45: " method: 'PUT',",
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
build115.jsView on unpkg · L2•matchType = normalized_sha256
matchedPackage = @ifasn/mmdd-doc-mcp@1.1.8
matchedPath = build115.js
matchedIdentity = npm:QGlmYXNuL21tZGQtZG9jLW1jcA:1.1.8
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
build115.jsView on unpkgfix104.js#virtual:normalized:round1View file
Findings
9 High1 Medium4 Low
HighCloud Metadata Accessbuild115.js
HighSemantic Analysis Limitedfix104.js#virtual:normalized:round1
HighKnown Malware Source Similaritybuild115.js
HighKnown Malware Source Similaritybuild116.js
HighKnown Malware Source Similarityfix104.js
HighKnown Malware Source Similaritypatch104.js
HighKnown Malware Source Similaritypatch105.js
HighKnown Malware Source Similarityrewrite111.js
HighPrevious Version Dangerous Deltaindex.js
MediumNetwork
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @ifasn/mmdd-doc-mcp@1.1.9-2.
See all versions of @ifasn/mmdd-doc-mcp for other recorded verdicts.
- Avoid installing @ifasn/mmdd-doc-mcp@1.1.9-2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.