{"id":"MAL-2026-18486","summary":"Malicious code in @ifasn/md-doc-mcp (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb)\nThe package is advertised as a markdown toolkit MCP server (TOC generation, word count, table formatting) but on require() of its main module and on startup of its md-doc-mcp bin it probes cloud-provider instance-metadata services — AWS IMDSv1/v2 (169.254.169.254), GCP, Azure, and Alibaba Cloud (100.100.100.200) — and sends the per-endpoint responses as query-string parameters over plain HTTP to a hardcoded external host 121.199.24.94, reached both as a bare IP and via the nip.io wildcard-DNS alias 121.199.24.94.nip.io. The outbound request is shaped as `?stage=report&src=md-doc-mcp&nodes=\u003cresults\u003e`. Source-level naming (`CONFIG_NODES`, `HEALTH_PROBES`, `pingTelemetry`) and Chinese-language comments describing the behavior as enterprise configuration sync and a status-code-only usage ping do not match the actual URLs probed or the destination contacted; IMDS endpoints are not configuration services, and the destination is an unrelated third-party IP rather than any first-party publisher infrastructure. The combination of cloud-metadata enumeration unrelated to the package's declared purpose, plaintext HTTP exfiltration to a bare-IP host disguised through nip.io, and automatic execution on import/startup identifies installers' cloud environments to a third party and provides reconnaissance for follow-on cloud-credential or instance attacks.\n","modified":"2026-11-02T21:15:06.842734679Z","published":"2026-11-02T20:58:44Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-11-02T20:58:44Z","sha256":"808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb","source":"amazon-inspector","versions":["1.0.5"],"id":"IN-MAL-2026-022493","import_time":"2026-11-02T21:10:55.293208865Z"},{"import_time":"2026-11-02T21:10:55.868288619Z","modified_time":"2026-11-02T20:59:48Z","sha256":"d37d60d7e1b4af36eb2a180e4275392067975b96de90c1093974005ff6fbeff4","source":"amazon-inspector","versions":["1.0.3"],"id":"IN-MAL-2026-022501"},{"id":"IN-MAL-2026-022506","import_time":"2026-11-02T21:10:56.27863913Z","modified_time":"2026-11-02T21:00:26Z","sha256":"e0bb69de5181a0d909fd4906be4d067ab91b2e8b880a17992202bb354881346d","source":"amazon-inspector","versions":["1.0.4"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ifasn/md-doc-mcp/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ifasn/md-doc-mcp/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ifasn/md-doc-mcp/v/1.0.4"}],"affected":[{"package":{"name":"@ifasn/md-doc-mcp","ecosystem":"npm","purl":"pkg:npm/%40ifasn/md-doc-mcp"},"versions":["1.0.5","1.0.3","1.0.4"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"89298b6753c862d20b71117cb83c75cd53f255b687187fe46bb1d5e6dceffd2c","tlsh":"6b02e988a4f774260228d0b4945b941ff17592433485ed62fb9cc5583f8e4a8e5ee7fc","path":"index.js"}],"package_integrity":[{"hashes":{"sha1":"e2e27babbfdf87e479ce24f5632ba8532b1f8aa2","sha512_sri":"sha512-Qc646JUFck0a0iTy3x0i8o0OZXO9YCTWpJgsXw+S2/PrNYlek5PslRq6lXdEiD8LMnvCZElXI1UHc3xNfAy95A=="},"filename":"md-doc-mcp-1.0.5.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ifasn/md-doc-mcp/MAL-2026-18486.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}