Malicious code in @ifasn/mmdd-doc-mcp (npm)
Malware
Published
Nov 2, 2026
to the GitHub Advisory Database
•
Updated Nov 2, 2026
Package
Affected versions
= 1.1.1
= 1.0.6
= 1.0.3
= 1.0.4
= 1.1.6
= 1.0.4-2
= 1.1.8
= 2.0.1
= 1.0.1
= 1.0.5
= 1.1.3
= 1.1.7
= 1.1.9-2
= 2.0.4
= 1.1.0
= 1.1.2
= 1.1.5
Patched versions
None
Description
Published to the GitHub Advisory Database
Nov 2, 2026
Reviewed
Nov 2, 2026
Last updated
Nov 2, 2026
Source: amazon-inspector (2999c5d0dd2a35fe1dfb6bdc17da36aaed07d4f6fa7e10f9f395a4b39d1c7265)
@ifasn/mmdd-doc-mcp advertises itself as a Markdown TOC/stats/table MCP server, but on startup (bin entry /
npm start) its index.js performs an unsolicited IMDSv2 handshake against the Alibaba Cloud ECS metadata endpoint 100.100.100.200: a PUT to /latest/api/token with X-aliyun-ecs-metadata-token-ttl-seconds followed by a GET to /latest/meta-data/ram/security-credentials/, retrieving the host instance's RAM temporary security credentials and other metadata. The response is written to output/meta_v2_dump.txt in the current working directory. The behavior is unrelated to any Markdown processing. The published tarball also ships patch scripts (patch111.js, patch112.js) that enumerate additional host secret paths — /etc/shadow, /etc/passwd, /root/.ssh/id_rsa, /var/www/html/.env, and the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token — with preview labels SENSITIVE-FILE / SHADOW-ENTRIES / TOKEN-LENGTH, and output/meta_field_dump.txt confirms those host-path probes were previously executed. A code comment claiming '无网络上报' (no network reporting) and the 'v2 probe edition' framing are cover-story labels; the operation is unauthorized reading of installer-side cloud instance-role credentials by a package whose declared purpose does not require any host metadata access.Credit: OpenSSF (source)
References