---
id: "MAL-2026-18489"
kind: "package"
aliases: ["MAL-2026-18489"]
title: "Malicious code in @ifasn/mmdd-doc-mcp (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@ifasn/mmdd-doc-mcp", "fixed": [], "affected": "= 1.1.1; = 1.0.6; = 1.0.3; = 1.0.4; = 1.1.6; = 1.0.4-2; = 1.1.8; = 2.0.1; = 1.0.1; = 1.0.5; = 1.1.3; = 1.1.7; = 1.1.9-2; = 2.0.4; = 1.1.0; = 1.1.2; = 1.1.5", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-11-02T20:58:12+00:00"
first_seen_at: "2026-11-02T21:35:22+00:00"
updated_at: "2026-11-02T21:37:01+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-18489", "first_seen_at": "2026-11-02T21:35:22+00:00"}]
---

# Malicious code in @ifasn/mmdd-doc-mcp (npm)

## Affected

- npm:@ifasn/mmdd-doc-mcp affected = 1.1.1; = 1.0.6; = 1.0.3; = 1.0.4; = 1.1.6; = 1.0.4-2; = 1.1.8; = 2.0.1; = 1.0.1; = 1.0.5; = 1.1.3; = 1.1.7; = 1.1.9-2; = 2.0.4; = 1.1.0; = 1.1.2; = 1.1.5 fixed ?

## Timeline

- 2026-11-02T21:35:22+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-18489

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2999c5d0dd2a35fe1dfb6bdc17da36aaed07d4f6fa7e10f9f395a4b39d1c7265)
@ifasn/mmdd-doc-mcp advertises itself as a Markdown TOC/stats/table MCP server, but on startup (bin entry / `npm start`) its index.js performs an unsolicited IMDSv2 handshake against the Alibaba Cloud ECS metadata endpoint 100.100.100.200: a PUT to /latest/api/token with X-aliyun-ecs-metadata-token-ttl-seconds followed by a GET to /latest/meta-data/ram/security-credentials/, retrieving the host instance's RAM temporary security credentials and other metadata. The response is written to output/meta_v2_dump.txt in the current working directory. The behavior is unrelated to any Markdown processing. The published tarball also ships patch scripts (patch111.js, patch112.js) that enumerate additional host secret paths — /etc/shadow, /etc/passwd, /root/.ssh/id_rsa, /var/www/html/.env, and the Kubernetes service-account token at /var/run/secrets/kubernetes.io/serviceaccount/token — with preview labels SENSITIVE-FILE / SHADOW-ENTRIES / TOKEN-LENGTH, and output/meta_field_dump.txt confirms those host-path probes were previously executed. A code comment claiming '无网络上报' (no network reporting) and the 'v2 probe edition' framing are cover-story labels; the operation is unauthorized reading of installer-side cloud instance-role credentials by a package whose declared purpose does not require any host metadata access.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_