{"id":"MAL-2026-18603","kind":"package","aliases":["MAL-2026-18603"],"related":[],"title":"Malicious code in @ifasn/ms-doc-mcp (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (89e10b57cd0911868969f2eaaa148e203d93745c5873d17c19e92ecec24d903d)\nPackage advertises itself as a Markdown toolkit MCP server (TOC generation, word count, table formatting) but its main/bin entry unconditionally invokes an imdsAudit() routine at module load that probes the Alibaba Cloud instance metadata service at http://100.100.100.200. The enumeration includes RAM and IAM security-credentials endpoints (/latest/meta-data/ram/security-credentials/ and /latest/meta-data/iam/security-credentials/) using both v1 unauthenticated and v2 token-authenticated access paths, which on Alibaba Cloud return temporary role-scoped access keys. Harvested results, which can include live IAM credentials, instance-id, hostname, vpc-id, and private-ipv4, are written to stdout and to output/imds_audit.txt. Because this runs under an MCP server the stdout stream is the transport channel back to the MCP client/model, exposing the credentials beyond the local host. Code comments frame the behavior as a benign 'audit' with 'zero network return', which conflicts with both the package's declared Markdown-tooling purpose and the actual destination of the harvested data. Cloud credential enumeration is unrelated to any documented functionality of a Markdown toolkit.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@ifasn/ms-doc-mcp","fixed":[],"affected":"= 2.0.9; = 2.1.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-04T06:11:33+00:00","first_seen_at":"2026-11-04T07:25:17+00:00","triaged_at":"2026-11-04T07:26:18+00:00","updated_at":"2026-11-04T07:26:18+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18603':8A,11A '-2026':7A,10A '/latest/meta-data/iam/security-credentials':79C '/latest/meta-data/ram/security-credentials':77C '100.100.100.200':66C '89e10':28C 'access':89C,100C 'actual':181C 'advertis':31C 'alibaba':60C,93C 'amazon':26C 'amazon-inspector':25C 'audit':162C 'authent':88C 'b57cd0911868969f2eaaa148e203d93745c5873d17c19e92ecec24d903d':29C 'back':142C 'behavior':158C 'benign':161C 'beyond':150C 'channel':141C 'client/model':146C 'cloud':61C,94C,187C 'code':2A,154C 'comment':155C 'conflict':168C 'count':42C 'credenti':75C,109C,149C,188C 'data':186C 'declar':174C 'destin':182C 'detail':17C 'document':194C 'edit':20C 'endpoint':76C 'entri':48C 'enumer':68C,189C 'expos':147C 'format':44C 'frame':156C 'function':195C 'generat':40C 'harvest':102C,185C 'host':153C 'hostnam':113C 'iam':72C,108C 'id':112C,116C 'ifasn/ms-doc-mcp':4A,12A 'imdsaudit':52C 'includ':69C,106C 'inspector':27C 'instanc':62C,111C 'instance-id':110C 'invok':50C 'ipv4':120C 'key':101C 'line':23C 'live':107C 'load':56C 'local':152C 'main/bin':47C 'mal':6A,9A 'malici':1A,13B 'markdown':35C,176C,198C 'markdown-tool':175C 'mcp':37C,133C,145C 'metadata':63C 'modul':55C 'network':165C 'npm':5A 'output/imds_audit.txt':127C 'packag':14B,30C,172C 'path':90C 'per':15C 'privat':119C 'private-ipv4':118C 'probe':58C 'purpos':178C 'ram':70C 'result':103C 'return':95C,166C 'role':98C 'role-scop':97C 'routin':53C 'run':130C 'scope':99C 'secur':74C 'security-credenti':73C 'server':38C,134C 'servic':64C 'sourc':16C,24C 'stdout':124C,136C 'stream':137C 'tabl':43C 'temporari':96C 'toc':39C 'token':87C 'token-authent':86C 'tool':177C 'toolkit':36C,199C 'transport':140C 'unauthent':83C 'uncondit':49C 'unrel':191C 'use':80C 'v1':82C 'v2':85C 'vpc':115C 'vpc-id':114C 'word':41C 'written':122C 'zero':164C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["msdocmcp"],"ptokens":["doc","ifasn","mcp","ms"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"first_public_at":"2026-11-04T06:11:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18603","url":"https://osv.dev/vulnerability/MAL-2026-18603","severity":"critical","published_at":"2026-11-04T06:11:33+00:00","modified_at":"2026-11-04T06:30:04+00:00","first_seen_at":"2026-11-04T07:25:17+00:00","fetched_at":"2026-11-04T07:25:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}