Malicious code in PayPalMerchant.SDK (NuGet)
Malicious code was discovered in multiple versions of the PayPalMerchant.SDK NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
- Disclosed
- Last updated
- Blast radius
- All users of affected PayPalMerchant.SDK NuGet package versions
- Ecosystems
- Attack vectors
- Affected entities
- PayPalMerchant.SDKNuGet package with malicious code
Multiple versions of the PayPalMerchant.SDK package distributed via NuGet were found to contain malicious code. The package is a third-party SDK used for PayPal merchant integration in .NET applications.\n\nThe malicious versions were identified and cataloged by the OpenSSF's malicious packages project (reference: MAL-2024-4611). The incident was published on GitHub advisories on 2026-07-20.\n\nAny application that installed affected versions of PayPalMerchant.SDK from NuGet would have been exposed to the malicious code. Users should immediately audit their dependencies and remove or update to a clean version if they have used this package.
Indicators of compromise
- Packages
- PayPalMerchant.SDK
Remediation
- Identify all projects using PayPalMerchant.SDK from NuGet
- Remove or update to a verified clean version of the package
- Review application logs and system activity for signs of compromise during the period the malicious package was installed
- Consider using alternative PayPal SDK implementations or official PayPal libraries
- Implement package verification and security scanning in your dependency management pipeline
Sources
- GitHub Advisory GHSA-vw9c-37q2-v97f · GitHub Advisory Database
Cite this entry
"Malicious code in PayPalMerchant.SDK (NuGet)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malicious-code-in-paypalmerchant-sdk-nuget-rhv7mn
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in Ultimate.Wpf.Toolkit (NuGet)
Multiple versions of the Ultimate.Wpf.Toolkit NuGet package contained malicious code. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in YoutubeExtractor.Net (NuGet)
Malicious code was discovered in the YoutubeExtractor.Net NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Zendesk.OAuth (NuGet)
Malicious code was discovered in multiple versions of the Zendesk.OAuth NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Winforms (NuGet)
Malicious code was discovered in multiple versions of the Winforms package on NuGet. The incident was documented by the OpenSSF malicious packages project and published as GitHub advisory GHSA-wq82-5xjm-57wq.
NuGetCompromised package