MSC-2026-6389

mlflow-ui is a malicious PyPI package impersonating an MLflow UI component. On installation it executes a payload that exfiltrates the installing machine's environment variables and harvests live cloud credentials. All published versions originate from the attacker; the package has been removed...