Multiple versions of the CaptchaCsharp package on NuGet have been identified as containing malicious code, as reported by the OpenSSF malicious packages database and tracked under MAL-2024-4433. This represents a malicious package incident rather than a traditional vulnerability. The affected versions are numerous and specific, indicating targeted malicious releases rather than a continuous range. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

Use of any of the affected CaptchaCsharp package versions may result in the introduction of malicious code into dependent software projects. This can lead to compromise of the software supply chain, potential execution of unauthorized code, and downstream security risks. The exact impact depends on the nature of the malicious code, which is not detailed in the provided information.

Since no official patch or remediation guidance is provided, the recommended action is to immediately stop using the affected versions of CaptchaCsharp. Users should remove these versions from their projects and replace them with a verified clean version or an alternative package. Additionally, auditing existing deployments for the presence of these versions is advised. Monitor official sources for any updates or vendor advisories regarding remediation.