The markdown-to-html package in the NuGet ecosystem has been identified as containing malicious code in specific versions: 1.0.0, 1.0.30, and 1.0.32. This is a case of a malicious package rather than a traditional vulnerability. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported. The threat is documented by the OpenSSF malicious packages database and tracked under MAL-2025-2922 and GHSA-gxwg-vw4q-2q8q.

Using the affected versions of the markdown-to-html package may result in the execution of malicious code embedded within the package. This can compromise the security and integrity of applications that depend on these versions. The exact impact depends on the malicious payload but generally poses a risk of unauthorized code execution or data compromise.

Avoid using the affected versions (=1.0.0, =1.0.30, =1.0.32) of the markdown-to-html package. Since no patch or fixed version is indicated, users should remove or replace these versions with a trusted alternative or wait for an official fix. Monitor official sources for updates or advisories regarding remediation.