{"id":"MAL-2026-18603","summary":"Malicious code in @ifasn/ms-doc-mcp (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (89e10b57cd0911868969f2eaaa148e203d93745c5873d17c19e92ecec24d903d)\nPackage advertises itself as a Markdown toolkit MCP server (TOC generation, word count, table formatting) but its main/bin entry unconditionally invokes an imdsAudit() routine at module load that probes the Alibaba Cloud instance metadata service at http://100.100.100.200. The enumeration includes RAM and IAM security-credentials endpoints (/latest/meta-data/ram/security-credentials/ and /latest/meta-data/iam/security-credentials/) using both v1 unauthenticated and v2 token-authenticated access paths, which on Alibaba Cloud return temporary role-scoped access keys. Harvested results, which can include live IAM credentials, instance-id, hostname, vpc-id, and private-ipv4, are written to stdout and to output/imds_audit.txt. Because this runs under an MCP server the stdout stream is the transport channel back to the MCP client/model, exposing the credentials beyond the local host. Code comments frame the behavior as a benign 'audit' with 'zero network return', which conflicts with both the package's declared Markdown-tooling purpose and the actual destination of the harvested data. Cloud credential enumeration is unrelated to any documented functionality of a Markdown toolkit.\n","modified":"2026-11-04T06:30:04.804261664Z","published":"2026-11-04T06:11:33Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["2.0.9"],"id":"IN-MAL-2026-022535","import_time":"2026-11-04T06:20:41.333005475Z","modified_time":"2026-11-04T06:11:33Z","sha256":"89e10b57cd0911868969f2eaaa148e203d93745c5873d17c19e92ecec24d903d"},{"sha256":"f8a9d0dad59c110339d1e7b526dfddaea8bd9121da0acdb8d7ffd299a4d10537","source":"amazon-inspector","versions":["2.1.1"],"id":"IN-MAL-2026-022537","import_time":"2026-11-04T06:20:41.491406022Z","modified_time":"2026-11-04T06:11:51Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ifasn/ms-doc-mcp/v/2.0.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ifasn/ms-doc-mcp/v/2.1.1"}],"affected":[{"package":{"name":"@ifasn/ms-doc-mcp","ecosystem":"npm","purl":"pkg:npm/%40ifasn/ms-doc-mcp"},"versions":["2.0.9","2.1.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ifasn/ms-doc-mcp/MAL-2026-18603.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"ms-doc-mcp-2.0.9.tgz","hashes":{"sha1":"b65455820dee98fab61211c2af0e6b971b522d59","sha512_sri":"sha512-mz+A7+yzjncu4OUWkFWpH7GwOwJBXxM7NuISBMYh7HA1x67MFR0g6dD26Rc6Upvy3/zM+ysP4ddXOWy0gGd19A=="}}],"evidence_files":[{"path":"index.js","sha256":"e685d160b6d1780fe3024e4336d090a928ce071d4d3829b20db52198c8269a61","tlsh":"4512c705f1b738350a59a1749a0bc41eb935e6033986de50f65cc2682f8d4ac96bbbfc"}]}}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}