The Sanka.UI2.WinForms package on NuGet, specifically versions 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, and 0.1.8, has been identified as containing malicious code. This classification is based on the OpenSSF malicious packages database and reported under the identifier MAL-2024-4637. There is no detailed vulnerability or exploit description beyond the presence of malicious code. No vendor advisory or patch information is available, and the package is not a cloud service.

Use of these affected versions of the Sanka.UI2.WinForms package may result in the introduction of malicious code into dependent software projects. This can lead to compromise of the build environment, execution of unauthorized code, or other security risks associated with supply chain malware. No specific exploit in the wild has been reported.

Since no official patch or remediation guidance is provided, the recommended mitigation is to avoid using the affected versions of the Sanka.UI2.WinForms package (0.1.3 through 0.1.8). Users should remove these versions from their dependencies and seek alternative trusted packages. Monitor official NuGet and OpenSSF advisories for updates or fixed versions.