The nbitcoin.unified package on NuGet has been identified as containing malicious code in several discrete versions ranging from 0.0.25 through 1.2.7. This classification is based on the OpenSSF malicious packages database and tracked under MAL-2025-191609. The threat is categorized as a malicious package rather than a traditional vulnerability. There is no CVSS score or detailed exploit data, and no vendor advisory or patch information is available. The affected versions are explicitly enumerated, indicating these specific releases contain the malicious code.

Use of the affected versions of the nbitcoin.unified package may result in the introduction of malicious code into dependent applications, potentially compromising application integrity or security. The exact impact is not detailed, and no known exploits have been reported in the wild. The presence of malicious code implies a risk of unauthorized actions or data compromise depending on the payload and usage context.

No official patch or remediation guidance is currently available. Users should avoid using the affected versions of the nbitcoin.unified package. It is recommended to audit dependencies and replace or remove this package from projects. Monitor official NuGet and OpenSSF advisories for updates or fixed versions. Since this is a malicious package, remediation involves removing or replacing the affected versions rather than applying a patch.