Which versions of mlflow-ui are malicious?

The following PyPI versions of mlflow-ui are flagged malicious: 2.7.1, 2.7.2, 2.7.3. Treat any of these as compromised.

How do I remediate mlflow-ui if I installed it?

mlflow-ui is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed mlflow-ui — how do I know if it already compromised me?

If mlflow-ui was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is mlflow-ui part of a known attack campaign?

Yes — mlflow-ui is associated with the 2026-07-mlflow-ui, IN-MAL-2026-010890, IN-MAL-2026-010889 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find mlflow-ui across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for mlflow-ui (3 malicious versions).

Malicious package

mlflow-uiPyPI

Advisory published Jul 18, 2026Updated Sep 9, 2026

mlflow-ui is a confirmed malicious PyPI package (MAL-2026-10779) that steals credentials and exfiltrates sensitive data (malicious versions 2.7.1, 2.7.2, 2.7.3). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in mlflow-ui (PyPI)

MAL-2026-10779

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall mlflow-ui

What this malware does

The package impersonates the MLflow project (author 'MLflow Community' [email protected], homepage https://github.com/mlflow/mlflow) but provides no MLflow UI functionality. Both setup.py (install time) and mlflow_ui/init.py (import time) execute payload_core.py, which collects hostname, platform, the full process environment (dict(os.environ)), /etc/hosts, /etc/resolv.conf, /proc/self/cgroup, /proc/1/cmdline, directory listings of /, /app, /opt, /srv, /home, /tmp, and the output of id, ps aux, and ip addr, along with internal-network probe results. The data is base64-encoded and POSTed to https://webhook.site/9510ba0a-29f7-4ce6-afe7-632c92cf0f41/piprecon over TLS with verification disabled (ssl.create_unverified_context()). The same module fetches a second-stage Python payload from https://webhook.site/a9f5802b-c77e-4226-99dd-bc89d7dc8cca/s2.py and passes the bytes to compile()+exec() with subprocess and os bound in globals, yielding arbitrary remote code execution on the installer's host at both install and import time. Bulk environment scraping captures AWS*, GH_TOKEN, npm/PyPI tokens, database URLs, and any other CI/build secrets present.

During installation, the package first collects local information, environment variables, and probes connections to typically expected services like databanks. Results are exfiltrated and then, the next stage code is downloaded and executed. It then continues exfiltrating data by looking for credentials to databases, exfiltrating SQLite databases and bruteforcing&exfiltrating other databases reachable from the running environment.

This package was created by Anthropic's AI agent during an internal experiment in a wrongly configured test environment.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-mlflow-ui

Reasons (based on the campaign):

files-exfiltration
exfiltration-env-variables
dependency-confusion
Downloads and executes a remote malicious script.
exfiltration-credentials
network-scan
exfiltration-cloud-tokens

Malicious versions

3 flagged

2.7.12.7.22.7.3

Indicators of compromise (SHA-256)

efedaf471fdd5b95baee95d9bd0d330c8ce0f5da06b5cdf89458fd4ea7a38015

77ab1bbfc9287ae255dbdbd3284995c4955261b11b78b6d25fb6521b69ec7469

b7192c53fc1e0b62e2c373a8a6beabfeb3777cae3aacfe23ca374eab1c2839a7

6cab767f1b4b6a2317a51983e7c8e45d6c16b50852e652f4a1e2a485ca0ab336

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for mlflow-ui (3 malicious versions).
If you installed it — respond
mlflow-ui is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If mlflow-ui was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. mlflow-ui on PyPI has been identified as a malicious package (versions 2.7.1, 2.7.2, 2.7.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-07-mlflow-uiIN-MAL-2026-010890IN-MAL-2026-010889

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks mlflow-ui-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database