The ml-nps-shared package versions 6.0.3 and 8.2.3 include malicious code that, upon installation, collects and exfiltrates basic system information such as IP address and username, as well as all environment variables. This exfiltration of sensitive data indicates a clear malicious intent typical of infostealer campaigns. No CVSS score or vendor advisory is available, and no patch or fix has been documented. The package is not a cloud service, so remediation depends on user action to remove or avoid these versions.

The impact involves unauthorized disclosure of sensitive system information and environment variables, which could lead to further compromise depending on the data exfiltrated. The risk is described as limited, but the presence of malicious code in a package installer can undermine system confidentiality and trust in the supply chain.

No official patch or remediation is documented. Users should avoid installing the affected versions 6.0.3 and 8.2.3 of the ml-nps-shared package. If these versions are installed, remove them immediately and verify system integrity. Monitor for any unusual outbound network activity that could indicate data exfiltration. Patch status is not yet confirmed — check the vendor advisory or PyPI security notices for updates.