{"id":"MAL-2026-18489","kind":"package","aliases":["MAL-2026-18489"],"related":[],"title":"Malicious code in @ifasn/mmdd-doc-mcp (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2999c5d0dd2a35fe1dfb6bdc17da36aaed07d4f6fa7e10f9f395a4b39d1c7265)\n@ifasn/mmdd-doc-mcp advertises itself as a Markdown TOC/stats/table MCP server, but on startup (bin entry / `npm start`) its index.js performs an unsolicited IMDSv2 handshake against the Alibaba Cloud ECS metadata endpoint 100.100.100.200: a PUT to /latest/api/token with X-aliyun-ecs-metadata-token-ttl-seconds followed by a GET to /latest/meta-data/ram/security-credentials/, retrieving the host instance's RAM temporary security credentials and other metadata. The response is written to output/meta_v2_dump.txt in the current working directory. The behavior is unrelated to any Markdown processing. The published tarball also ships patch scripts (patch111.js, patch112.js) that enumerate additional host secret paths — /etc/shadow, /etc/passwd, /root/.ssh/id_rsa, /var/www/html/.env, and the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token — with preview labels SENSITIVE-FILE / SHADOW-ENTRIES / TOKEN-LENGTH, and output/meta_field_dump.txt confirms those host-path probes were previously executed. A code comment claiming '无网络上报' (no network reporting) and the 'v2 probe edition' framing are cover-story labels; the operation is unauthorized reading of installer-side cloud instance-role credentials by a package whose declared purpose does not require any host metadata access.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@ifasn/mmdd-doc-mcp","fixed":[],"affected":"= 1.1.1; = 1.0.6; = 1.0.3; = 1.0.4; = 1.1.6; = 1.0.4-2; = 1.1.8; = 2.0.1; = 1.0.1; = 1.0.5; = 1.1.3; = 1.1.7; = 1.1.9-2; = 2.0.4; = 1.1.0; = 1.1.2; = 1.1.5","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:58:12+00:00","first_seen_at":"2026-11-02T21:35:22+00:00","triaged_at":"2026-11-02T21:37:01+00:00","updated_at":"2026-11-02T21:37:01+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18489':8A,11A '-2026':7A,10A '/etc/passwd':126C '/etc/shadow':125C '/latest/api/token':63C '/latest/meta-data/ram/security-credentials':78C '/root/.ssh/id_rsa':127C '/var/run/secrets/kubernetes.io/serviceaccount/token':137C '/var/www/html/.env':128C '100.100.100.200':59C '2999c5d0dd2a35fe1dfb6bdc17da36aaed07d4f6fa7e10f9f395a4b39d1c7265':28C 'access':206C 'account':134C 'addit':121C 'advertis':30C 'alibaba':54C 'aliyun':67C 'also':113C 'amazon':26C 'amazon-inspector':25C 'behavior':103C 'bin':41C 'claim':164C 'cloud':55C,189C 'code':2A,162C 'comment':163C 'confirm':152C 'cover':177C 'cover-stori':176C 'credenti':87C,193C 'current':99C 'declar':198C 'detail':17C 'directori':101C 'ec':56C,68C 'edit':20C,173C 'endpoint':58C 'entri':42C,146C 'enumer':120C 'execut':160C 'file':143C 'follow':73C 'frame':174C 'get':76C 'handshak':51C 'host':81C,122C,155C,204C 'host-path':154C 'ifasn/mmdd-doc-mcp':4A,12A,29C 'imdsv2':50C 'index.js':46C 'inspector':27C 'instal':187C 'installer-sid':186C 'instanc':82C,191C 'instance-rol':190C 'kubernet':131C 'label':140C,179C 'length':149C 'line':23C 'mal':6A,9A 'malici':1A,13B 'markdown':34C,108C 'mcp':36C 'metadata':57C,69C,90C,205C 'network':167C 'npm':5A,43C 'oper':181C 'output/meta_field_dump.txt':151C 'output/meta_v2_dump.txt':96C 'packag':14B,196C 'patch':115C 'patch111.js':117C 'patch112.js':118C 'path':124C,156C 'per':15C 'perform':47C 'preview':139C 'previous':159C 'probe':157C,172C 'process':109C 'publish':111C 'purpos':199C 'put':61C 'ram':84C 'read':184C 'report':168C 'requir':202C 'respons':92C 'retriev':79C 'role':192C 'script':116C 'second':72C 'secret':123C 'secur':86C 'sensit':142C 'sensitive-fil':141C 'server':37C 'servic':133C 'service-account':132C 'shadow':145C 'shadow-entri':144C 'ship':114C 'side':188C 'sourc':16C,24C 'start':44C 'startup':40C 'stori':178C 'tarbal':112C 'temporari':85C 'toc/stats/table':35C 'token':70C,135C,148C 'token-length':147C 'ttl':71C 'unauthor':183C 'unrel':105C 'unsolicit':49C 'v2':171C 'whose':197C 'work':100C 'written':94C 'x':66C 'x-aliyun-ecs-metadata-token-ttl-second':65C '无网络上报':165C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["mmdddocmcp"],"ptokens":["doc","ifasn","mcp","mmdd"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-02T20:58:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18489","url":"https://osv.dev/vulnerability/MAL-2026-18489","severity":"critical","published_at":"2026-11-02T20:58:12+00:00","modified_at":"2026-11-02T21:15:06+00:00","first_seen_at":"2026-11-02T21:35:22+00:00","fetched_at":"2026-11-02T21:35:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}