Malicious Core ML package with a MIL fill op whose attacker-controlled shape drives np.full to request a 100000 by 100000 fp32 allocation.
This repository is public and gated for Protect AI review. protectai-bot has been granted access by the uploader.
