The googleads.api package on NuGet was found to contain malicious code in multiple specific versions, as identified by the OpenSSF malicious packages project. This is classified as a malicious package incident rather than a software vulnerability. The affected versions include all from 0.0.1 to 0.0.40 and versions 2.45.7 to 2.45.9. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

Users who have installed any of the affected versions of the googleads.api package may have inadvertently introduced malicious code into their environments. This could lead to compromise depending on the nature of the malicious code, though specific impacts are not detailed in the source data. No known active exploitation has been reported.

Since no official patch or remediation guidance is provided, the recommended action is to immediately remove and replace any affected versions of the googleads.api package with a trusted, verified version or alternative. Users should verify package integrity before installation and monitor for updates from the package maintainers or NuGet repository. Patch status is not yet confirmed — check the vendor advisory or NuGet repository for current remediation guidance.