MalwarePublished 25 Jun 2024Updated 20 Jul 2026

SharpCashAddr.Core (NuGet) · Malicious Code

Affects SharpCashAddr.CoreSource GCVE Database

Malicious package : remove SharpCashAddr.Core and rotate any secrets on hosts that installed it.

Data as of 20 Jul 2026, 20:04 UTC

Classification

Malicious package

Published to NuGet · OSV MAL-2024-4641

What to do

Remove SharpCashAddr.Core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
NuGetSharpCashAddr.Core`pkg:nuget/SharpCashAddr.Core`Other threats	Affected =1.0.1 =1.0.2 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

SharpCashAddr.Core NuGet package versions 1.0.0, 1.0.1, and 1.0.2 contain malicious code. This is a supply chain threat involving a malicious package published to the NuGet ecosystem. No specific technical details or exploitation methods are provided in the source data.

Impact

Users who install or depend on the affected SharpCashAddr.Core package versions may be exposed to malicious code execution or other malicious activities embedded within the package. The exact impact is not detailed, but supply chain malware can lead to compromise of dependent applications or environments.

Defensive guidance

Users should avoid using the affected versions (=1.0.0, =1.0.1, =1.0.2) of SharpCashAddr.Core. It is recommended to check the NuGet repository or vendor advisories for updated, clean versions or alternative packages. Monitor official sources for any forthcoming remediation or guidance.

Summary

The SharpCashAddr.Core package versions 1.0.0, 1.0.1, and 1.0.2 have been identified as containing malicious code, as reported by the OpenSSF malicious packages database and tracked under MAL-2024-4641. This represents a supply chain compromise where the package itself is malicious. No CVSS score or detailed vulnerability description is available, and no known exploits in the wild have been reported.

References

github.com/advisories/GHSA-q43r-jgm6-42ff (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 20 Jul 2026, 20:04 UTC

Technical details

References

Community reviews