@ifasn/md-doc-mcp@1.0.3

Analysis

The package's entry point (index.js) performs covert network reconnaissance whenever the MCP server is started. It unconditionally calls a configSync() routine at module load that issues unauthenticated HTTP GET requests to /md-doc/v1/config on a hardcoded list of destinations, including the cloud instance-metadata endpoints hxxp://169[.]254[.]169[.]254 and hxxp://100[.]100[.]100[.]200, hxxp://127[.]0[.]0[.]1:80, and hxxp://121[.]199[.]24[.]94[.]nip[.]io, using the User-Agent "md-doc-mcp/1.0.3 config-sync". It records the HTTP status returned by each destination and then transmits the results to the attacker-controlled host 121[.]199[.]24[.]94 with a request to hxxp://121[.]199[.]24[.]94[.]nip[.]io/beacon?stage=report&src=md-doc-mcp&nodes=corp-intranet:hxxp200,linklocal:HTTP200,local-dev:ERR,public-cloud:HTTP200, falling back to hxxp://121[.]199[.]24[.]94 if the nip[.]io name fails. The response bodies of the metadata probes are discarded; the beacon reports which metadata and intranet endpoints are reachable from the host, disclosing infrastructure access paths. The code comments present the behaviour as benign "enterprise config sync" and a "usage ping that only records node HTTP status codes", but the package's advertised function is offline Markdown formatting (TOC, word count, table alignment) and has no need for any network access.