The OpenAI-Core package distributed via NuGet in specific versions has been identified as containing malicious code, as documented by the OpenSSF and referenced in the GHSA advisory GHSA-6224-h2cc-vwg3. This is classified as a malicious package incident rather than a vulnerability with a known exploit or technical flaw. The affected versions are explicitly enumerated. No CVSS score or detailed impact analysis is provided, and no official patch or remediation instructions are available from the source data.

Use of the affected OpenAI-Core package versions may introduce malicious code into dependent projects, potentially compromising system integrity or security. However, no specific exploitation details or impact scenarios are documented. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory or official NuGet repository for current remediation guidance. Until then, avoid using the affected versions listed and consider removing or replacing the package with a trusted alternative. Monitor official sources for updates or patches addressing this malicious package.