MalwarePublished 25 Jun 2024Updated 20 Jul 2026

BitPay.Net (NuGet) · Malicious Code

Affects BitPay.NetSource GCVE Database

Malicious package : remove BitPay.Net and rotate any secrets on hosts that installed it.

Data as of 20 Jul 2026, 20:43 UTC

Classification

Malicious package

Published to NuGet · OSV MAL-2024-4311

What to do

Remove BitPay.Net from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
NuGetBitPay.Net`pkg:nuget/BitPay.Net`Other threats	Affected =5.0.2 =5.0.1 =5.0.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

BitPay.Net NuGet packages versions 5.0.1, 5.0.2, and 5.0.3 have been identified as containing malicious code. This issue is categorized as a malicious package threat rather than a traditional software vulnerability. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported. No official patch or remediation guidance is provided in the source data.

Impact

Use of the affected BitPay.Net package versions could lead to the introduction of malicious code into dependent projects, potentially compromising the security and integrity of applications that incorporate these packages. The exact impact depends on the nature of the malicious code, which is not detailed in the available data. No confirmed exploitation in the wild has been reported.

Defensive guidance

Users should avoid using the affected versions (=5.0.1, =5.0.2, =5.0.3) of BitPay.Net. It is recommended to verify the authenticity and integrity of packages before use and to monitor official sources for updates or safer versions.

Summary

The BitPay.Net NuGet package versions 5.0.1, 5.0.2, and 5.0.3 have been flagged as containing malicious code according to the OpenSSF malicious packages database (MAL-2024-4311). This classification indicates that these package versions may include intentionally harmful or unauthorized code that could compromise systems using them. There is no detailed technical information or CVSS scoring available, and no known active exploitation has been reported. The threat is specific to these exact package versions.

References

github.com/advisories/GHSA-5hf6-89cx-3gmw (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 20 Jul 2026, 20:43 UTC

Technical details

References

Community reviews