OpenSSF/OSV advisory MAL-2026-3602 confirms this npm version as malicious. This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @ml-toolkit-ts/xgboost (npm)
Details
This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor.
The package will steal credentials and then propogate it to every package it has access to. The package also attempts to remain persistent.
Decision reason
OpenSSF Malicious Packages via OSV confirms @ml-toolkit-ts/xgboost@1.0.4 as malicious (MAL-2026-3602): Malicious code in @ml-toolkit-ts/xgboost (npm)