Malicious code has been identified in specific versions of the CCXT.NET.API package distributed via NuGet. The affected versions are 1.4.13, 1.4.14, and 1.4.16. This is classified as a malicious package threat rather than a traditional software vulnerability. There is no CVSS score available for this threat, and no known exploits in the wild have been reported as of the publication date.