Advisories for Npm/@Mcptoolshop/Backpropagate package

2026

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

In backpropagate >= 1.1.0, the optional Reflex web UI (pip install backpropagate[ui], launched via backprop ui) exposes a training control plane: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push. The CLI accepts two operator-facing flags intended as security controls: –auth user:pass — documented as "require HTTP Basic authentication on every request to the UI." –share — documented as "expose the UI on a public …