Malicious code in OCI.DotNetSDK.Osubusage.Net (NuGet)
Malicious code was discovered in the OCI.DotNetSDK.Osubusage.Net NuGet package. The package was identified by the OpenSSF malicious packages project and reported via GitHub Advisory GHSA-6hmv-h8cf-m32h.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of affected versions
- Ecosystems
- Attack vectors
- Affected entities
- OCI.DotNetSDK.Osubusage.NetNuGet package
A malicious package named OCI.DotNetSDK.Osubusage.Net was published to the NuGet package registry. The package contained malicious code and was identified as part of the OpenSSF's malicious packages tracking effort.\n\nThe advisory was published on July 20, 2026, and assigned GitHub Advisory ID GHSA-6hmv-h8cf-m32h. The discovery was credited to the OpenSSF malicious packages project, which maintains a public database of known malicious packages across multiple ecosystems.\n\nUsers of this package should immediately remove it from their projects and dependencies.
Indicators of compromise
- Packages
- OCI.DotNetSDK.Osubusage.Net
Remediation
- Remove OCI.DotNetSDK.Osubusage.Net from all projects and dependency chains
- Audit project history for any versions of this package that may have been installed
- Review any systems that may have executed code from this package for signs of compromise
- Update to legitimate alternatives if the package was providing required functionality
- Monitor for any related malicious packages with similar naming patterns
Sources
- GitHub Advisory GHSA-6hmv-h8cf-m32h · GitHub Advisory Database
Cite this entry
"Malicious code in OCI.DotNetSDK.Osubusage.Net (NuGet)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malicious-code-in-oci-dotnetsdk-osubusage-net-nuget-83qozv
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in intercom-php (Packagist)
The intercom-php package on Packagist was compromised with malicious code as part of the Mini Shai-Hulud campaign by the TeamPCP threat actor. The malicious payload steals credentials and can propagate to NPM packages using discovered credentials.
Mini Shai HuludTeamPCPNuGetCompromised packageMalicious maintainer - resolvedcritical
Malicious code in Ultimate.Wpf.Toolkit (NuGet)
Multiple versions of the Ultimate.Wpf.Toolkit NuGet package contained malicious code. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in YoutubeExtractor.Net (NuGet)
Malicious code was discovered in the YoutubeExtractor.Net NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Zendesk.OAuth (NuGet)
Malicious code was discovered in multiple versions of the Zendesk.OAuth NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package