The npm package @ifasn/md-doc-mcp contains malicious code that, upon import or startup, probes cloud instance metadata services from AWS, GCP, Azure, and Alibaba Cloud. It exfiltrates the collected metadata via plaintext HTTP requests to a hardcoded external IP address and its nip.io alias. This behavior is unrelated to the package's declared markdown toolkit functionality and is disguised by misleading source code comments. The exfiltration of cloud environment details enables third-party reconnaissance for potential follow-on attacks targeting cloud credentials or instances.