The ml-nps-shared package on PyPI contains malicious code that exfiltrates basic system information and all environment variables during installation. This behavior classifies it as an infostealer with limited risk. The affected versions are 6.0.3 and 8.2.3. No official patch or remediation guidance is provided. There are no known exploits in the wild at this time.