MalwarePublished 25 Jun 2024Updated 20 Jul 2026

Altcoins (NuGet) · Malicious Code

Affects AltcoinsSource GCVE Database

Malicious package : remove Altcoins and rotate any secrets on hosts that installed it.

Data as of 20 Jul 2026, 20:45 UTC

Classification

Malicious package

Published to NuGet · OSV MAL-2024-4000

What to do

Remove Altcoins from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
NuGetAltcoins`pkg:nuget/Altcoins`Other threats	Affected 1.0.0 – 1.45.25 37 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The Altcoins NuGet package contains malicious code in multiple specific versions. This is identified as a malicious package threat rather than a traditional software vulnerability. The affected versions are numerous discrete releases of the Altcoins package. No CVSS score is provided, and no official patch or remediation guidance is available from the vendor.

Impact

Use of any of the affected Altcoins package versions may result in execution of malicious code, which could compromise the security and integrity of dependent applications. The exact impact depends on the nature of the malicious code but generally includes potential unauthorized actions by attackers leveraging the compromised package.

Defensive guidance

Users should avoid using the affected versions of the Altcoins package listed and obtain packages only from trusted sources. Consider removing or replacing the affected packages with verified clean versions or alternatives. Monitor official advisories for updates or fixes.

Summary

This threat involves malicious code embedded in the Altcoins package distributed via the NuGet ecosystem. Multiple specific versions of the package, including 1.0.0 through 1.0.34 and select 1.45.x versions, are affected. The source of this information is the OpenSSF malicious packages repository, tracked under MAL-2024-4000 and GHSA-9hrh-rx4m-2c3p. There is no detailed technical vulnerability description or exploit information available. This is classified as a malicious package incident rather than a software vulnerability with a patch.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 20 Jul 2026, 20:45 UTC

Technical details

References

Community reviews