Pathoschild.Stardew.ModBuildConfig.Net (NuGet) · Malicious Code

The Pathoschild.Stardew.ModBuildConfig.Net NuGet package contains malicious code in multiple specific versions. This is a supply chain threat where the package itself is compromised to deliver malicious payloads. No CVSS score or detailed technical exploitation data is available. The affected versions are explicitly identified, indicating targeted versions of the package. There is no information about known exploits in the wild or vendor patches.

• reversinglabs.com/blog/malicious-nuget-campaign-uses-homoglyphs-and-il-weaving-to-fool-devs (opens in a new tab)
• github.com/advisories/GHSA-cx5p-wmv9-whj5 (opens in a new tab)