The PyPI package 'my-mcp-server-driving-license-ocr' version 0.1.3 contains malicious code that sends user-supplied driving license images to a hardcoded, non-secure IP address over plaintext HTTP. This behavior bypasses any user configuration and exposes personally identifiable information to an unknown and undisclosed endpoint.