The ml-shared package on PyPI versions 6.3.0 and 8.8.0 contains malicious code that exfiltrates basic system information and all environment variables during installation. This behavior classifies the package as a malicious infostealer with limited risk. No official patch or remediation guidance is currently available.