Multiple specific versions of the Sanka.UI3.WinForms package on NuGet have been identified as containing malicious code, as reported by the OpenSSF malicious packages repository and tracked under MAL-2024-4638. The affected versions are explicitly enumerated, indicating targeted versions rather than a broad range. There is no CVSS score or detailed vulnerability description available, and no known exploits in the wild have been reported. This is a supply chain threat involving a malicious package rather than a traditional software vulnerability.

Use of the affected Sanka.UI3.WinForms package versions may introduce malicious code into dependent applications, potentially compromising application integrity or security. The exact impact depends on the nature of the malicious code, which is not detailed in the provided data. No known active exploitation has been reported at this time.

No official patch or fixed versions are indicated in the provided data. Users should avoid using the listed affected versions of Sanka.UI3.WinForms. It is recommended to verify package integrity and source authenticity before use. Check the vendor or repository advisories for updates or safe versions. Since this is a malicious package issue, removing or replacing the affected versions with trusted alternatives is advised.