@ifasn/ms-doc-mcp

{"modified":"2026-11-04T06:22:29Z","published":"2026-11-04T06:11:33Z","schema_version":"1.7.4","id":"MAL-2026-18603","summary":"Malicious code in @ifasn/ms-doc-mcp (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (89e10b57cd0911868969f2eaaa148e203d93745c5873d17c19e92ecec24d903d)\nPackage advertises itself as a Markdown toolkit MCP server (TOC generation, word count, table formatting) but its main/bin entry unconditionally invokes an imdsAudit() routine at module load that probes the Alibaba Cloud instance metadata service at http://100.100.100.200. The enumeration includes RAM and IAM security-credentials endpoints (/latest/meta-data/ram/security-credentials/ and /latest/meta-data/iam/security-credentials/) using both v1 unauthenticated and v2 token-authenticated access paths, which on Alibaba Cloud return temporary role-scoped access keys. Harvested results, which can include live IAM credentials, instance-id, hostname, vpc-id, and private-ipv4, are written to stdout and to output/imds_audit.txt. Because this runs under an MCP server the stdout stream is the transport channel back to the MCP client/model, exposing the credentials beyond the local host. Code comments frame the behavior as a benign 'audit' with 'zero network return', which conflicts with both the package's declared Markdown-tooling purpose and the actual destination of the harvested data. Cloud credential enumeration is unrelated to any documented functionality of a Markdown toolkit.\n","affected":[{"package":{"ecosystem":"npm","name":"@ifasn/ms-doc-mcp"},"versions":["2.0.9","2.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"e685d160b6d1780fe3024e4336d090a928ce071d4d3829b20db52198c8269a61","tlsh":"4512c705f1b738350a59a1749a0bc41eb935e6033986de50f65cc2682f8d4ac96bbbfc"}],"package_integrity":[{"filename":"ms-doc-mcp-2.0.9.tgz","hashes":{"sha1":"b65455820dee98fab61211c2af0e6b971b522d59","sha512_sri":"sha512-mz+A7+yzjncu4OUWkFWpH7GwOwJBXxM7NuISBMYh7HA1x67MFR0g6dD26Rc6Upvy3/zM+ysP4ddXOWy0gGd19A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ifasn/ms-doc-mcp/v/2.0.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ifasn/ms-doc-mcp/v/2.1.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022535","import_time":"2026-11-04T06:20:41.333005475Z","modified_time":"2026-11-04T06:11:33Z","sha256":"89e10b57cd0911868969f2eaaa148e203d93745c5873d17c19e92ecec24d903d","source":"amazon-inspector","versions":["2.0.9"]},{"id":"IN-MAL-2026-022537","import_time":"2026-11-04T06:20:41.491406022Z","modified_time":"2026-11-04T06:11:51Z","sha256":"f8a9d0dad59c110339d1e7b526dfddaea8bd9121da0acdb8d7ffd299a4d10537","source":"amazon-inspector","versions":["2.1.1"]}]}}