Multiple versions of the DiscordRPC.Net.Core package on NuGet have been identified as containing malicious code, as reported by the OpenSSF and tracked under MAL-2024-4468. The affected versions are explicitly enumerated and include numerous 1.0.x releases as well as some 3.45.x and 5.4.x versions. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported. This represents a malicious package insertion in the supply chain rather than a traditional vulnerability.

Users who install any of the affected versions of DiscordRPC.Net.Core risk executing malicious code embedded in the package. This can lead to compromise of the development or deployment environment depending on the nature of the malicious payload. The exact impact depends on the malicious code's behavior, which is not detailed in the provided data.

No official patch or remediation guidance is currently available. Users should avoid using the affected versions of DiscordRPC.Net.Core and obtain the package only from trusted sources. Monitor vendor advisories and the NuGet repository for updates or removal of malicious versions. Consider scanning existing projects for usage of these specific versions and replace or remove them.