The Stl.CommandLine.Net package versions 0.2.22 and 0.2.23 have been flagged as containing malicious code according to the OpenSSF malicious packages database (MAL-2024-4656). This represents a supply chain compromise where the package itself is malicious, potentially impacting any software that depends on these specific versions. There is no detailed information on the nature of the malicious code or its capabilities. No official patch or remediation guidance is provided in the source data.

Use of the affected versions of Stl.CommandLine.Net (0.2.22 and 0.2.23) may introduce malicious code into dependent applications, potentially leading to compromise of the software supply chain. The exact impact depends on the malicious payload, which is not detailed in the available data. There are no known exploits in the wild reported at this time.

Since no official patch or remediation is indicated, users should avoid using the affected versions 0.2.22 and 0.2.23 of Stl.CommandLine.Net. Consider removing or replacing these versions with a clean or verified alternative. Monitor the vendor or repository for any updates or advisories. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.