{"id":"MAL-2026-18486","kind":"package","aliases":["MAL-2026-18486"],"related":[],"title":"Malicious code in @ifasn/md-doc-mcp (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb)\nThe package is advertised as a markdown toolkit MCP server (TOC generation, word count, table formatting) but on require() of its main module and on startup of its md-doc-mcp bin it probes cloud-provider instance-metadata services — AWS IMDSv1/v2 (169.254.169.254), GCP, Azure, and Alibaba Cloud (100.100.100.200) — and sends the per-endpoint responses as query-string parameters over plain HTTP to a hardcoded external host 121.199.24.94, reached both as a bare IP and via the nip.io wildcard-DNS alias 121.199.24.94.nip.io. The outbound request is shaped as `?stage=report&src=md-doc-mcp&nodes=<results>`. Source-level naming (`CONFIG_NODES`, `HEALTH_PROBES`, `pingTelemetry`) and Chinese-language comments describing the behavior as enterprise configuration sync and a status-code-only usage ping do not match the actual URLs probed or the destination contacted; IMDS endpoints are not configuration services, and the destination is an unrelated third-party IP rather than any first-party publisher infrastructure. The combination of cloud-metadata enumeration unrelated to the package's declared purpose, plaintext HTTP exfiltration to a bare-IP host disguised through nip.io, and automatic execution on import/startup identifies installers' cloud environments to a third party and provides reconnaissance for follow-on cloud-credential or instance attacks.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@ifasn/md-doc-mcp","fixed":[],"affected":"= 1.0.5; = 1.0.3; = 1.0.4","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:58:44+00:00","first_seen_at":"2026-11-02T21:35:22+00:00","triaged_at":"2026-11-02T21:37:01+00:00","updated_at":"2026-11-02T21:37:01+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18486':8A,11A '-2026':7A,10A '100.100.100.200':79C '121.199.24.94':100C '121.199.24.94.nip.io':115C '169.254.169.254':73C '808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb':28C 'actual':163C 'advertis':32C 'alia':114C 'alibaba':77C 'amazon':26C 'amazon-inspector':25C 'attack':245C 'automat':221C 'aw':71C 'azur':75C 'bare':105C,214C 'bare-ip':213C 'behavior':146C 'bin':61C 'chines':141C 'chinese-languag':140C 'cloud':65C,78C,198C,227C,241C 'cloud-credenti':240C 'cloud-metadata':197C 'cloud-provid':64C 'code':2A,155C 'combin':195C 'comment':143C 'config':134C 'configur':149C,174C 'contact':169C 'count':42C 'credenti':242C 'declar':206C 'describ':144C 'destin':168C,178C 'detail':17C 'disguis':217C 'dns':113C 'doc':59C,127C 'edit':20C 'endpoint':85C,171C 'enterpris':148C 'enumer':200C 'environ':228C 'execut':222C 'exfiltr':210C 'extern':98C 'first':190C 'first-parti':189C 'follow':238C 'follow-on':237C 'format':44C 'gcp':74C 'generat':40C 'hardcod':97C 'health':136C 'host':99C,216C 'http':94C,209C 'identifi':225C 'ifasn/md-doc-mcp':4A,12A 'imd':170C 'imdsv1/v2':72C 'import/startup':224C 'infrastructur':193C 'inspector':27C 'instal':226C 'instanc':68C,244C 'instance-metadata':67C 'ip':106C,185C,215C 'languag':142C 'level':132C 'line':23C 'main':50C 'mal':6A,9A 'malici':1A,13B 'markdown':35C 'match':161C 'mcp':37C,60C,128C 'md':58C,126C 'md-doc-mcp':57C,125C 'metadata':69C,199C 'modul':51C 'name':133C 'nip.io':110C,219C 'node':129C,135C 'npm':5A 'outbound':117C 'packag':14B,30C,204C 'paramet':91C 'parti':184C,191C,232C 'per':15C,84C 'per-endpoint':83C 'ping':158C 'pingtelemetri':138C 'plain':93C 'plaintext':208C 'probe':63C,137C,165C 'provid':66C,234C 'publish':192C 'purpos':207C 'queri':89C 'query-str':88C 'rather':186C 'reach':101C 'reconnaiss':235C 'report':123C 'request':118C 'requir':47C 'respons':86C 'send':81C 'server':38C 'servic':70C,175C 'shape':120C 'sourc':16C,24C,131C 'source-level':130C 'src':124C 'stage':122C 'startup':54C 'status':154C 'status-code-on':153C 'string':90C 'sync':150C 'tabl':43C 'third':183C,231C 'third-parti':182C 'toc':39C 'toolkit':36C 'unrel':181C,201C 'url':164C 'usag':157C 'via':108C 'wildcard':112C 'wildcard-dn':111C 'word':41C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["mddocmcp"],"ptokens":["doc","ifasn","mcp","md"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-02T20:58:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18486","url":"https://osv.dev/vulnerability/MAL-2026-18486","severity":"critical","published_at":"2026-11-02T20:58:44+00:00","modified_at":"2026-11-02T21:15:06+00:00","first_seen_at":"2026-11-02T21:35:22+00:00","fetched_at":"2026-11-02T21:35:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}