⌘ + K

MAL-2026-18489

Dashboard / Malicious Package / MAL-2026-18489

MAL-2026-18489

Published: 2 Nov 2026Last Modified: 2 Nov 2026

Summary: Malicious code in @ifasn/mmdd-doc-mcp (npm)

Details: Source: amazon-inspector (2999c5d0dd2a35fe1dfb6bdc17da36aaed07d4f6fa7e10f9f395a4b39d1c7265) @ifasn/mmdd-doc-mcp advertises itself as a Markdown TOC/stats/table MCP server, but on startup (bin entry / `npm start`) its index.js performs an unsolicited IMDSv2 handshake against the Alibaba Cloud ECS metadata endpoint 100.100.100.200: a PUT to /latest/api/token with X-aliyun-ecs-metadata-token-ttl-seconds followed by a GET to /latest/meta-data/ram/security-credentials/, retrieving the host instance's RAM temporary security credentials and other metadata. The response is written to output/meta_v2_dump.txt in the current working directory. The behavior is unrelated to any Markdown processing. The published tarball also ships patch scripts (patch111.js, patch112.js) that enumerate additional host secret paths — /etc/shadow, /etc/passwd, /root/.ssh/id_rsa, /var/www/html/.env, and the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token — with preview labels SENSITIVE-FILE / SHADOW-ENTRIES / TOKEN-LENGTH, and output/meta_field_dump.txt confirms those host-path probes were previously executed. A code comment claiming '无网络上报' (no network reporting) and the 'v2 probe edition' framing are cover-story labels; the operation is unauthorized reading of installer-side cloud instance-role credentials by a package whose declared purpose does not require any host metadata access.

Affected packages

Package

Name: @ifasn/mmdd-doc-mcp

Purl: pkg:npm/%40ifasn/mmdd-doc-mcp

Affected ranges

Type: N/A

Events:

Introduced- None

Fixed -None

Affected versions

1.1.1

1.1.6

1.1.8

1.1.3

1.1.7

1.1.9-2

1.1.0

1.1.2

1.1.5