@ifasn/md-doc-mcp

{"modified":"2026-11-02T21:12:25Z","published":"2026-11-02T20:58:44Z","schema_version":"1.7.4","id":"MAL-2026-18486","summary":"Malicious code in @ifasn/md-doc-mcp (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb)\nThe package is advertised as a markdown toolkit MCP server (TOC generation, word count, table formatting) but on require() of its main module and on startup of its md-doc-mcp bin it probes cloud-provider instance-metadata services — AWS IMDSv1/v2 (169.254.169.254), GCP, Azure, and Alibaba Cloud (100.100.100.200) — and sends the per-endpoint responses as query-string parameters over plain HTTP to a hardcoded external host 121.199.24.94, reached both as a bare IP and via the nip.io wildcard-DNS alias 121.199.24.94.nip.io. The outbound request is shaped as `?stage=report&src=md-doc-mcp&nodes=<results>`. Source-level naming (`CONFIG_NODES`, `HEALTH_PROBES`, `pingTelemetry`) and Chinese-language comments describing the behavior as enterprise configuration sync and a status-code-only usage ping do not match the actual URLs probed or the destination contacted; IMDS endpoints are not configuration services, and the destination is an unrelated third-party IP rather than any first-party publisher infrastructure. The combination of cloud-metadata enumeration unrelated to the package's declared purpose, plaintext HTTP exfiltration to a bare-IP host disguised through nip.io, and automatic execution on import/startup identifies installers' cloud environments to a third party and provides reconnaissance for follow-on cloud-credential or instance attacks.\n","affected":[{"package":{"ecosystem":"npm","name":"@ifasn/md-doc-mcp"},"versions":["1.0.5","1.0.3","1.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"89298b6753c862d20b71117cb83c75cd53f255b687187fe46bb1d5e6dceffd2c","tlsh":"6b02e988a4f774260228d0b4945b941ff17592433485ed62fb9cc5583f8e4a8e5ee7fc"}],"package_integrity":[{"filename":"md-doc-mcp-1.0.5.tgz","hashes":{"sha1":"e2e27babbfdf87e479ce24f5632ba8532b1f8aa2","sha512_sri":"sha512-Qc646JUFck0a0iTy3x0i8o0OZXO9YCTWpJgsXw+S2/PrNYlek5PslRq6lXdEiD8LMnvCZElXI1UHc3xNfAy95A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ifasn/md-doc-mcp/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ifasn/md-doc-mcp/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ifasn/md-doc-mcp/v/1.0.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022493","import_time":"2026-11-02T21:10:55.293208865Z","modified_time":"2026-11-02T20:58:44Z","sha256":"808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb","source":"amazon-inspector","versions":["1.0.5"]},{"id":"IN-MAL-2026-022501","import_time":"2026-11-02T21:10:55.868288619Z","modified_time":"2026-11-02T20:59:48Z","sha256":"d37d60d7e1b4af36eb2a180e4275392067975b96de90c1093974005ff6fbeff4","source":"amazon-inspector","versions":["1.0.3"]},{"id":"IN-MAL-2026-022506","import_time":"2026-11-02T21:10:56.27863913Z","modified_time":"2026-11-02T21:00:26Z","sha256":"e0bb69de5181a0d909fd4906be4d067ab91b2e8b880a17992202bb354881346d","source":"amazon-inspector","versions":["1.0.4"]}]}}