Multiple specific versions of the Ultimate.Wpf.Toolkit package on NuGet have been identified as containing malicious code. This was reported by the OpenSSF and tracked under MAL-2024-4691 and GHSA-m9mf-f7gx-x34w. The affected versions are explicitly enumerated and span many releases, indicating widespread compromise of this package. No detailed technical exploitation or impact information is provided beyond the presence of malicious code. There is no vendor advisory or patch information available in the provided data.

The presence of malicious code in these package versions can lead to compromise of systems that consume these packages, potentially allowing attackers to execute unauthorized actions depending on the nature of the malicious payload. However, specific impacts or exploitation details are not provided. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid using the affected versions and consider removing or replacing the Ultimate.Wpf.Toolkit package from their projects until a clean, verified version is available. Monitor official NuGet and vendor channels for updates or advisories regarding this package.