Multiple exact versions of the NuGet package Rg.Plugins.Popups.Net have been identified as containing malicious code. This was reported by the OpenSSF and cataloged under MAL-2024-4628. The affected versions are numerous and individually enumerated, indicating targeted malicious package uploads rather than a vulnerability in the package code itself. No CVSS score or detailed technical exploitation information is available. No vendor advisory or patch information is provided, and the package is not a cloud service.

Users who have integrated any of the specifically enumerated versions of Rg.Plugins.Popups.Net into their projects may be exposed to malicious code execution risks inherent in those package versions. This could lead to compromise of the development environment or downstream applications depending on the malicious payload, though specific impacts are not detailed in the source data.

No official patch or remediation guidance is provided in the source data. Users should avoid using any of the enumerated affected versions of Rg.Plugins.Popups.Net. It is recommended to remove these versions from projects and replace them with a trusted, verified version or alternative package. Check the vendor or NuGet repository for updates or official advisories. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.