The npm package @ifasn/mmdd-doc-mcp, which claims to be a Markdown TOC/stats/table MCP server, contains malicious code that, upon startup, performs unauthorized access to Alibaba Cloud ECS instance metadata service (IMDSv2). It retrieves temporary security credentials and sensitive host files such as /etc/shadow, /etc/passwd, SSH private keys, environment files, and Kubernetes service account tokens, writing this data to local files. This behavior is unrelated to the package's stated functionality and constitutes unauthorized credential and sensitive data harvesting.