@ifasn/mmdd-doc-mcp@2.0.1
Markdown document toolkit MCP server: TOC generation, word count, table formatting
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package automatically probes cloud instance metadata, including the RAM role listing, despite being a Markdown utility. Its entry point also sends probe statuses to a hard-coded external beacon, so this is malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Unconditional call to v2Probe() when index.js starts.
Impact
Unrequested collection of cloud instance metadata and disclosure of probe results to an unrelated host.
Mechanism
Requests an Aliyun metadata token, reads metadata including the RAM role listing, saves probe output locally, and sends result statuses to a hard-coded beacon.
Attack narrative
When the package entry point starts, it requests an Aliyun instance metadata v2 token and uses it to query metadata, including the RAM security-credentials role listing. It saves probe results locally and sends status information to a hard-coded external beacon. This automatic cloud metadata collection is unrelated to the package’s Markdown tools.
AI rationale
The package automatically probes cloud instance metadata, including the RAM role listing, despite being a Markdown utility. Its entry point also sends probe statuses to a hard-coded external beacon, so this is malicious behavior.
Evidence
index.jsoutput/meta_field_dump.txt
Network endpoints3
100.100.100.200121.199.24.94.nip.io121.199.24.94
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The entry point requests an Aliyun instance metadata v2 token from 100.100.100.200.
- With the token, it reads the instance metadata RAM security-credentials role listing.
- The metadata probe runs unconditionally when index.js starts.
- The probe sends its result statuses to a hard-coded external beacon and writes probe output to output/meta_field_dump.txt.
Evidence against
- The package describes Markdown table-of-contents, statistics, and table-formatting tools.
- package.json has no install lifecycle script.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
12 flaggedbuild115.jsView file
2L3: const NL = String.fromCharCode(10);
L4:
...
L13: ' */',
L14: 'const http = require("http");',
L15: 'const https = require("https");',
...
L34: ' req.on("error", () => done({ ok: false, status: "ERR", text: "" }));',
L35: ' req.end();',
L36: ' });',
...
L43: ' // v2 token 获取（PUT + TTL 头），内容只记长度不落盘',
L44: " const tok = await fetchText2('http://100.100.100.200/latest/api/token', 4000, {",
L45: " method: 'PUT',",
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
build115.jsView on unpkg · L2•matchType = normalized_sha256
matchedPackage = @ifasn/mmdd-doc-mcp@1.1.8
matchedPath = build115.js
matchedIdentity = npm:QGlmYXNuL21tZGQtZG9jLW1jcA:1.1.8
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
build115.jsView on unpkgfix104.js#virtual:normalized:round1View file
Findings
12 High1 Medium4 Low
HighCloud Metadata Accessbuild115.js
HighSemantic Analysis Limitedfix104.js#virtual:normalized:round1
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Similaritybuild115.js
HighKnown Malware Source Similaritybuild116.js
HighKnown Malware Source Similarityfix104.js
HighKnown Malware Source Similaritypatch104.js
HighKnown Malware Source Similaritypatch105.js
HighKnown Malware Source Similaritypatch119.js
HighKnown Malware Source Similarityrewrite111.js
HighKnown Malware Source Fingerprint Signatureindex.js
HighPrevious Version Dangerous Delta
Affected versions and remediation
This report applies to @ifasn/mmdd-doc-mcp@2.0.1.
See all versions of @ifasn/mmdd-doc-mcp for other recorded verdicts.
- Avoid installing @ifasn/mmdd-doc-mcp@2.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.