The BitPay.Net NuGet package versions 5.0.1, 5.0.2, and 5.0.3 have been flagged as containing malicious code according to the OpenSSF malicious packages database (MAL-2024-4311). This classification indicates that these package versions may include intentionally harmful or unauthorized code that could compromise systems using them. There is no detailed technical information or CVSS scoring available, and no known active exploitation has been reported. The threat is specific to these exact package versions.

Use of the affected BitPay.Net package versions could lead to the introduction of malicious code into dependent projects, potentially compromising the security and integrity of applications that incorporate these packages. The exact impact depends on the nature of the malicious code, which is not detailed in the available data. No confirmed exploitation in the wild has been reported.

No official patch or remediation guidance is provided in the available data. Users should avoid using the affected versions (=5.0.1, =5.0.2, =5.0.3) of BitPay.Net. It is recommended to verify the authenticity and integrity of packages before use and to monitor official sources for updates or safer versions. Patch status is not yet confirmed — check the vendor advisory or official NuGet repository for current remediation guidance.