The @ifasn/mdd-doc-mcp npm package contains malicious code that, upon loading, attempts to steal Alibaba Cloud ECS instance role credentials by querying the instance metadata service and extracting security tokens. It disguises this activity as benign diagnostics. Additionally, it downloads and executes a dependency from an untrusted HTTP source without integrity checks, enabling arbitrary code execution during installation. This behavior is unexpected given the package's declared purpose as a Markdown documentation tool.