The @ifasn/mmd-doc-mcp npm package contains malicious code that probes cloud instance metadata service endpoints for AWS, GCP, Azure, and Alibaba clouds. It collects HTTP status codes from these endpoints to identify the cloud provider and presence of attached IAM/RAM roles, then sends this data in plaintext to a hardcoded external server. The package falsely advertises itself as a markdown table-of-contents server, but performs unauthorized reconnaissance of cloud credentials metadata services.