The YoutubeExtractor.Net NuGet package version 5.0.3 contains malicious code as identified by the OpenSSF and reported in a public malware database. This is a supply chain threat involving a malicious package in the NuGet ecosystem. No CVSS score or detailed technical exploit information is available.