The hackney.core.jwt package on NuGet has been identified as containing malicious code. This is a supply chain threat where the package itself is intentionally harmful. There is no CVSS score or detailed technical vulnerability information available. No known exploits in the wild have been reported. The affected version is exactly 99.99.99, which appears to be a placeholder or non-standard version identifier.