MAL-2026-18489: Malicious code in @ifasn/mmdd-doc-mcp (npm)

Published Nov 2, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2999c5d0dd2a35fe1dfb6bdc17da36aaed07d4f6fa7e10f9f395a4b39d1c7265) @ifasn/mmdd-doc-mcp advertises itself as a Markdown TOC/stats/table MCP server, but on startup (bin entry / npm start) its index.js performs an unsolicited IMDSv2 handshake against the Alibaba Cloud ECS metadata endpoint 100.100.100.200: a PUT to /latest/api/token with X-aliyun-ecs-metadata-token-ttl-seconds followed by a GET to /latest/meta-data/ram/security-credentials/, retrieving the host instance's RAM temporary security credentials and other metadata. The response is written to output/metav2dump.txt in the current working directory. The behavior is unrelated to any Markdown processing. The published tarball also ships patch scripts (patch111.js, patch112.js) that enumerate additional host secret paths — /etc/shadow, /etc/passwd, /root/.ssh/idrsa, /var/www/html/.env, and the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token — with preview labels SENSITIVE-FILE / SHADOW-ENTRIES / TOKEN-LENGTH, and output/metafielddump.txt confirms those host-path probes were previously executed. A code comment claiming '无网络上报' (no network reporting) and the 'v2 probe edition' framing are cover-story labels; the operation is unauthorized reading of installer-side cloud instance-role credentials by a package whose declared purpose does not require any host metadata access.

Affected Software

1 affected component

npm/@ifasn/mmdd-doc-mcp=1.1.1, =1.0.6, =1.0.3, =1.0.4, =1.1.6, =1.0.4-2, =1.1.8, =2.0.1, =1.0.1, =1.0.5, =1.1.3, =1.1.7, =1.1.9-2, =2.0.4, =1.1.0, =1.1.2, =1.1.5

Event History

Nov 2, 2026

Advisory Published

via OSV·08:58 PM

Data Sourced

via OSV·08:58 PM

DescriptionAffected Software

Frequently Asked Questions

Which systems are most exposed if this package is executed?

Hosts where the package is started through its bin entry or npm start are exposed to its startup behavior. Alibaba Cloud ECS instances are particularly sensitive because the package contacts the Alibaba metadata endpoint and requests RAM temporary security credentials.

What does an attacker need in order for the credential collection to occur?

The package must be installed and its startup code executed. The metadata collection depends on the host being able to reach 100.100.100.200 and obtain a metadata token; the additional scripts target local files accessible to the process.

How can I check whether the package has already run on a host?

Check the current working directory used to run it for output/meta_v2_dump.txt and output/meta_field_dump.txt. Also review process and network telemetry for a PUT request to /latest/api/token followed by a GET request to /latest/meta-data/ram/security-credentials/ at 100.100.100.200.

Which local secrets were targeted by the included scripts?

The shipped patch scripts enumerate /etc/shadow, /etc/passwd, /root/.ssh/id_rsa, /var/www/html/.env, and /var/run/secrets/kubernetes.io/serviceaccount/token. Access to any of these files depends on the permissions of the process running the package.

MAL-2026-18489: Malicious code in @ifasn/mmdd-doc-mcp (npm)

Affected Software

Event History

Frequently Asked Questions

Which systems are most exposed if this package is executed?

What does an attacker need in order for the credential collection to occur?

How can I check whether the package has already run on a host?

Which local secrets were targeted by the included scripts?

Company

Resources

Contact

Frequently Asked Questions

Which systems are most exposed if this package is executed?

What does an attacker need in order for the credential collection to occur?

How can I check whether the package has already run on a host?

Which local secrets were targeted by the included scripts?