The DotSpatial.Modeling.Forms.Net NuGet package versions 4.0.656, 4.0.657, and 4.0.658 contain malicious code as identified by the OpenSSF project. This is a supply chain threat involving a malicious package published to the NuGet ecosystem. No specific technical details about the malicious behavior or exploitation methods are provided.