This threat concerns malicious code found in certain versions of the bitcoincore package on the NuGet ecosystem. The package versions explicitly identified as affected are 0.0.4, 0.0.9, 0.0.13, 0.0.18, 0.0.22, 1.0.24, and 1.0.25. The source of this information is the OpenSSF malicious packages repository, tracked under MAL-2025-191605 and GHSA-9gjc-2546-5v7h. There is no vendor advisory or patch information available, and no CVSS score has been assigned. This represents a malicious package incident rather than a vulnerability in the software itself.

The presence of malicious code in these specific package versions poses a risk of compromise to any systems or projects that have integrated these versions. The exact impact depends on the nature of the malicious code, which is not detailed in the provided data. No known active exploitation has been reported.

No official patch or remediation guidance is provided in the available data. Users should avoid using the affected versions of the bitcoincore package and remove or replace them with versions not listed as affected once available. Monitor official sources such as the OpenSSF repository or NuGet advisories for updates or fixed versions. Patch status is not yet confirmed — check the vendor advisory or official NuGet security advisories for current remediation guidance.