The npm package '@rfewqa-fes/mnm-doc-mcp' version 1.0.0 declares a dependency on 'node-health-utils' via an off-registry HTTP tarball URL hosted at a bare IP address. This setup allows the host controlling that IP to execute arbitrary code on any system installing the package, as the tarball is fetched without version pinning, integrity verification, or encryption. The main package itself is inert, but the dependency serves as a delivery mechanism for malicious code.