The MetroModern.UI2 package version 1.4.0 on NuGet has been identified as containing malicious code. This is a supply chain threat where the package itself is intentionally harmful. No CVSS score or detailed technical exploitation information is provided. There is no indication of known exploits in the wild or available patches.