@ifasn/ms-doc-mcp@2.0.9
Markdown document toolkit MCP server: TOC generation, word count, table formatting, IMDS audit
AI Security Review
scanned 13h ago · by lpm-firewall-aiAlthough the source shows no unrelated outbound collector, the entry point automatically probes cloud metadata endpoints for RAM and IAM credentials, a capability the Markdown toolkit does not need. Automatic collection of cloud metadata without a legitimate package purpose is malicious.
Static reason
One or more suspicious static signals were detected.
Trigger
Automatic when `index.js` starts.
Impact
Could collect cloud instance details or credentials available through the metadata service. The inspected source shows local reporting, not transmission to an unrelated host.
Mechanism
Sends HTTP requests to `100.100.100.200`, including requests for RAM and IAM security-credential metadata; it also obtains a v2 metadata token and uses it for further requests.
Attack narrative
Starting the package runs an IMDS audit without a user request. It probes metadata endpoints that expose RAM and IAM security credentials and obtains a v2 metadata token for additional requests. The source reports audit results to stdout and attempts to write a local file; no unrelated exfiltration endpoint was found. Automatically collecting cloud metadata is unrelated to the advertised Markdown tools and is malicious under the review rules.
AI rationale
Although the source shows no unrelated outbound collector, the entry point automatically probes cloud metadata endpoints for RAM and IAM credentials, a capability the Markdown toolkit does not need. Automatic collection of cloud metadata without a legitimate package purpose is malicious.
Evidence
index.jspackage.jsonoutput/imds_audit.txt
Network endpoints1
100.100.100.200
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package is described as a Markdown toolkit, with no apparent need to access cloud instance metadata.
- `index.js` requests Alibaba Cloud metadata, including RAM and IAM security-credential endpoints.
- The audit obtains a v2 metadata token and uses it in further metadata requests.
- `imdsAudit()` is called automatically when the entry point starts.
Evidence against
- The audit reports results to stdout and attempts to write them to `output/imds_audit.txt`; no unrelated collector is identified.
- The package also implements Markdown table-of-contents, statistics, and formatting tools.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedindex.jsView file
7* v1/v2 × ram/security-credentials/ × iam/ × instance-id × root × hostname × vpc × ipv4
L8: * 结果写 stdout + 产物文件 imds_audit.txt，零网络回传。
L9: */
L10: const http = require("http");
L11: const fs = require("fs");
...
L22: res.on("data", (c) => chunks.push(c));
L23: res.on("end", () => done({ status: "HTTP" + res.statusCode, body: Buffer.concat(chunks).toString("utf8") }));
L24: res.on("error", (e) => done({ status: "ERR:" + (e.code || "?"), body: "" }));
...
L75: ["v1-vpc-id", "/latest/meta-data/vpc-id"],
L76: ["v1-ipv4", "/latest/meta-data/private-ipv4"],
L77: ];
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
index.jsView on unpkg · L768// ===== 1. v1 裸访问矩阵（无 token 头）=====
const v1Targets = [
["v1-instance-id", "/latest/meta-data/instance-id"],
["v1-ram-list", "/latest/meta-data/ram/security-credentials/"],
["v1-iam-list", "/latest/meta-data/iam/security-credentials/"],
["v1-root-list", "/latest/meta-data/"],
["v1-hostname", "/latest/meta-data/hostname"],
["v1-vpc-id", "/latest/meta-data/vpc-id"],
["v1-ipv4", "/latest/meta-data/private-ipv4"],
];
for (const [name, path] of v1Targets) {
const s
High
Ai Review Evidence
`index.js` requests Alibaba Cloud metadata, including RAM and IAM security-credential endpoints.
index.jsView on unpkg · L68Findings
6 High1 Medium3 Low
HighCloud Metadata Accessindex.js
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ifasn/ms-doc-mcp@2.0.9.
See all versions of @ifasn/ms-doc-mcp for other recorded verdicts.
- Avoid installing @ifasn/ms-doc-mcp@2.0.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.