MAL-2026-18603: Malicious code in @ifasn/ms-doc-mcp (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (89e10b57cd0911868969f2eaaa148e203d93745c5873d17c19e92ecec24d903d) Package advertises itself as a Markdown toolkit MCP server (TOC generation, word count, table formatting) but its main/bin entry unconditionally invokes an imdsAudit() routine at module load that probes the Alibaba Cloud instance metadata service at http://100.100.100.200. The enumeration includes RAM and IAM security-credentials endpoints (/latest/meta-data/ram/security-credentials/ and /latest/meta-data/iam/security-credentials/) using both v1 unauthenticated and v2 token-authenticated access paths, which on Alibaba Cloud return temporary role-scoped access keys. Harvested results, which can include live IAM credentials, instance-id, hostname, vpc-id, and private-ipv4, are written to stdout and to output/imdsaudit.txt. Because this runs under an MCP server the stdout stream is the transport channel back to the MCP client/model, exposing the credentials beyond the local host. Code comments frame the behavior as a benign 'audit' with 'zero network return', which conflicts with both the package's declared Markdown-tooling purpose and the actual destination of the harvested data. Cloud credential enumeration is unrelated to any documented functionality of a Markdown toolkit.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to credential harvesting?
The package probes the Alibaba Cloud instance metadata service, including RAM and IAM security-credentials endpoints. Exposure is therefore relevant when it runs on an Alibaba Cloud instance where metadata access can return temporary role-scoped credentials.
What triggers the metadata-service probing?
The imdsAudit() routine is invoked unconditionally at module load through the package's main/bin entry. A user does not need to invoke a separate audit command or feature for the probing to occur.
What information can be exposed if the probe succeeds?
The harvested output can include live IAM credentials, instance ID, hostname, VPC ID, and private IPv4 address. It is written to stdout and to output/imds_audit.txt.
Why can MCP use increase the exposure of harvested data?
When the package runs as an MCP server, stdout is the transport channel back to the MCP client or model. Credentials and instance details written to stdout can therefore leave the local host through that channel.
Which metadata access methods does the package attempt?
It attempts both unauthenticated v1 and token-authenticated v2 access paths. The targeted endpoints include RAM and IAM security-credentials paths under /latest/meta-data/.