A malware campaign discovered on the NuGet package repository targets the cryptocurrency ecosystem by distributing 14 malicious packages impersonating legitimate crypto-related tools. These packages employ techniques such as homoglyphs, version bumping, and inflated download counts to appear trustworthy and evade detection. The malware aims to steal crypto funds by redirecting transactions and exfiltrating secrets, including OAuth tokens for Google Ads accounts. The campaign highlights the risks of software supply chain attacks, especially for projects relying on compromised dependencies. No known exploits in the wild have been reported yet, but the threat poses a significant risk to developers and organizations integrating these packages. The attack affects . NET developers using NuGet packages related to cryptocurrency and OAuth services. The severity is assessed as medium due to the potential confidentiality and financial impact, combined with moderate exploitation complexity. European organizations involved in blockchain development, fintech, and digital advertising are particularly at risk. Mitigation requires strict dependency vetting, use of package integrity verification, and monitoring of OAuth token usage.
The solnetunified NuGet package contains malicious code in specific versions. This threat involves the presence of intentionally harmful code within the package versions 0.0.15, 0.0.21, 0.0.65, and 1.45.6. There is no CVSS score available, and no known exploits in the wild have been reported. No patch or remediation information is provided, so users should avoid using these specific versions.
The solnetall NuGet package versions 0.0.2, 0.0.3, 0.0.7, 0.0.15, 0.0.18, 0.0.20, 2.56.2, and 2.56.3 contain malicious code. This is identified as a malicious package threat rather than a traditional vulnerability. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported.
The solnetplus NuGet package contains malicious code in multiple specific versions. This threat involves the presence of intentionally harmful code within the package versions listed, which could compromise systems using these versions. No official patch or remediation guidance is currently provided. There are no known exploits in the wild at this time.
The nethereumunified package on NuGet contains malicious code in multiple specific versions. This threat involves the presence of intentionally harmful code within the package versions listed, which could compromise systems using these versions. There is no CVSS score available for this threat, and no known exploits in the wild have been reported. No official patch or remediation guidance is provided in the source data.
The solananet NuGet package contains malicious code in multiple specific versions. This is identified as a malicious package threat rather than a traditional vulnerability. The affected versions include 0.0.0, 0.0.3, 0.0.13, 0.0.14, and 1.56.1 through 1.56.4. There is no CVSS score or detailed impact description available. No known exploits in the wild have been reported. No patch or remediation information is provided.
The nbitcoin.unified NuGet package contains malicious code in multiple specific versions. This threat involves the presence of intentionally harmful code within the package distributed via the NuGet ecosystem. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported. The affected versions are explicitly identified, but no patch or remediation guidance is provided.
The bybitapi.net NuGet package contains malicious code in specific versions. This threat involves the presence of malicious functionality within the package versions 0.0.7, 1.24.5, 1.24.6, 1.24.7, and 1.24.8. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported as of the publication date.
The coinbase.net.api NuGet package versions 0.0.2 through 0.0.9 and 1.0.1 through 1.0.5 have been identified as containing malicious code. This is a supply chain threat involving a malicious package published to the NuGet ecosystem. There is no CVSS score or detailed technical exploitation information available. No known exploits in the wild have been reported to date.
The googleads.api NuGet package versions 0.0.1 through 0.0.40 and 2.45.7 through 2.45.9 have been identified as containing malicious code. This is a case of a malicious package rather than a traditional vulnerability. There is no CVSS score or detailed technical exploit information available. No official patch or remediation guidance is provided.
The binance.csharp NuGet package contains malicious code in multiple specific versions. This is a supply chain threat where the package itself is compromised to potentially perform unauthorized or harmful actions. The affected versions include a wide range of releases identified explicitly by version number.
Malicious code has been identified in specific versions of the bitcoincore package distributed via NuGet. The affected versions include 0.0.4, 0.0.9, 0.0.13, 0.0.18, 0.0.22, 1.0.24, and 1.0.25. This is a supply chain threat involving a malicious package rather than a traditional software vulnerability. There is no CVSS score or detailed technical exploitation information available. No known exploits in the wild have been reported as of the publication date.
CVE-2025-62171 is an integer overflow vulnerability in the BMP decoder of Magick.NET Q16 AnyCPU (ImageMagick). The vulnerability affects 32-bit systems with manually increased resource limits and allows a crafted BMP file to trigger a denial-of-service via AddressSanitizer crashes. The originally released patch in ImageMagick 7.1.2-2 is incomplete, and versions up to 7.1.2-5 remain vulnerable. The issue arises because the overflow check is performed after the integer overflow occurs, making it ineffective. A fix is available in version 14.9.0.
Apache ActiveMQ NMS AMQP Client versions up to 2.3.0 contain a critical deserialization of untrusted data vulnerability. This flaw allows malicious AMQP servers to exploit unbounded deserialization logic in the client, potentially leading to arbitrary code execution. Although version 2.1.0 introduced allow/deny list protections, these were bypassable under certain conditions. The issue is resolved in version 2.4.0 and later. Users are advised to upgrade and migrate away from .NET binary serialization for long-term security.
The Kubernetes C# client contains a vulnerability in its certificate validation logic that improperly accepts certificates from any Certificate Authority without verifying the trust chain. This flaw could allow attackers to present forged certificates, enabling man-in-the-middle attacks and impersonation of the Kubernetes API server. The issue affects versions prior to 17.0.14 and has been assigned CVE-2025-9708. A patch is available in version 17.0.14 to address this vulnerability.
A heap out-of-bounds write vulnerability exists in the BlobStream component of ImageMagick 7 (MagickCore) due to improper handling of forward seeks beyond the current buffer extent. This allows an attacker to write controlled bytes at an attacker-chosen offset beyond the allocated memory, leading to memory corruption and potential remote code execution. The flaw affects versions prior to 14.8.2 and has been confirmed on macOS arm64 and is architecture-agnostic on LP64 systems. The vulnerability arises because the WriteBlob function grows the buffer insufficiently when the offset is far beyond the current extent, causing a deterministic heap overflow. The vulnerability has a CVSS score of 3.8 with low severity in the Magick.NET Q16 x64 context, but the underlying ImageMagick flaw is rated 9.8 in CVSS v3.1. A fix is available in version 14.8.2.
A 32-bit integer overflow vulnerability exists in the BMP encoder of Magick.NET Q16 AnyCPU (ImageMagick) when writing BMP scanline stride. This overflow causes the computed stride (bytes_per_line) to become much smaller than the actual row size for 24-bpp images, leading to an attacker-controlled heap out-of-bounds write during BMP image conversion. The issue affects 32-bit builds and can cause heap corruption, potentially leading to denial of service or remote code execution. The vulnerability is fixed in version 14.8.1.
A format string vulnerability exists in the InterpretImageFilename function of Magick.NET Q16 AnyCPU before version 14.8.1. This flaw allows user input containing format specifiers to be passed unsanitized to a formatting function, potentially leading to arbitrary memory overwrite. Exploitation can result in heap buffer overflow and remote code execution. The issue is addressed in version 14.8.1.
A vulnerability in Magick.NET Q16 AnyCPU (ImageMagick) allows a denial of service via a divide-by-zero error. Passing a geometry string containing only a colon (":") to the montage command causes the internal GetGeometry() function to set width and height to zero. This leads to a division by zero in the ThumbnailImage() function, causing the process to crash with a SIGFPE or abort signal. The issue affects versions prior to 14.8.1 and is fixed in 14.8.1.
CVE-2025-55154 is a high-severity vulnerability in ImageMagick's MNG image processing component. It involves integer overflow in magnified size calculations within the ReadOneMNGImage function, which can lead to memory corruption. This flaw affects versions prior to 14.8.0. A fix is available in version 14.8.0.
