Multiple specific versions of the Pathoschild.Stardew.Mod.BuildConfig package on NuGet have been identified as containing malicious code. This was reported by the OpenSSF malicious packages repository and tracked under MAL-2024-4608 and GHSA-f2f3-mxx6-vxrx. The affected versions include 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.3.1, and 6.5.1. There is no CVSS score or detailed technical analysis available, and no known exploits in the wild have been reported.

Users who install or use the affected versions of the Pathoschild.Stardew.Mod.BuildConfig NuGet package risk executing malicious code embedded within these versions. The exact impact or capabilities of the malicious code are not detailed in the provided information.

No official patch or remediation guidance is provided in the available data. Users should avoid using the affected versions listed and obtain the package only from trusted sources. Monitor the vendor or NuGet advisories for updates or fixed versions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.