The PyPI package 'ml-fdbk-shared' versions 1.0.0 and 2.3.1 contains malicious code that exfiltrates basic system information and all environment variables during installation. This behavior classifies the package as a malicious infostealer with limited risk. No official patch or remediation guidance is currently provided.