Multiple specific versions of the Pathoschild.Stardew.ModBuildConfig.Net package on NuGet have been identified as containing malicious code. This is a malicious package incident reported by the OpenSSF and tracked under MAL-2024-4609 and GHSA-cx5p-wmv9-whj5. The threat involves the presence of malicious code embedded within the package versions listed, posing a risk to users who install these versions. No detailed vulnerability mechanics or exploitation methods are provided. No patch or remediation information is available from the vendor or sources.

Users who install any of the affected versions of the Pathoschild.Stardew.ModBuildConfig.Net package risk executing malicious code embedded within these versions. This can lead to compromise of the development environment or downstream software depending on this package. There are no known exploits in the wild reported at this time.

Since no official patch or remediation guidance is provided, users should avoid using the affected versions listed. It is recommended to audit dependencies and remove or replace these versions with trusted alternatives. Monitor official advisories for updates or fixed versions. No vendor-provided fix is currently confirmed.