@ifasn md-doc-mcp typosquat family: npm packages steal cloud IMDS credentials and exfiltrate to 121.199.24.94
Severity: critical · Patch status: no-fix-needed · Since 2026-11-02
Four related npm packages published under the @ifasn scope, all posing as Markdown documentation MCP servers, contain malicious code that runs automatically on import, startup, or npm install. The packages probe cloud instance-metadata services (AWS IMDSv1/v2, GCP, Azure, Alibaba Cloud at 100.100.100.200), including IMDSv2 token handshakes and the ram/security-credentials/ path that returns STS AccessKeyId/Secret/SecurityToken for the instance's RAM role, and exfiltrate results over plaintext HTTP to a hardcoded bare IP 121.199.24.94 (also via 121.199.24.94.nip.io), disguised with cover-story identifiers like CONFIGNODES, HEALTHPROBES, and pingTelemetry. One package also pins a dependency to an HTTP tarball on the same IP, giving install-time code execution, and another ships patch scripts enumerating /etc/shadow, SSH keys, .env files, and Kubernetes service-account tokens. All affected versions remain unpatched; anyone who installed them, especially on cloud VMs with attached IAM/RAM roles, should rotate credentials immediately.
What to do
- Immediately uninstall all @ifasn md-doc-mcp variants and audit lockfiles and node_modules for their presence
- Rotate cloud instance-role credentials (AWS IAM, Alibaba RAM STS tokens) on any host where the packages ran; treat them as compromised
- Review cloud provider logs for outbound connections to 121.199.24.94 or 121.199.24.94.nip.io and for IMDSv2 token requests
- Check hosts for output/meta_field_dump.txt, output/meta_v2_dump.txt, and other artifacts indicating sensitive-file or credential access
- Block egress to 121.199.24.94 and enforce IMDSv2 (token-required) on cloud instances
- Audit npm dependencies for HTTP-pinned tarballs and lifecycle scripts; prefer registry-pinned, integrity-checked packages
Sources
All live incidents on Threat Watch
