Malicious code in psbuiId (NuGet)
Malicious code was discovered in the psbuiId NuGet package. The package was identified by the OpenSSF malicious-packages project and assigned identifier MAL-2024-4618.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of affected versions
- Ecosystems
- Attack vectors
- Affected entities
- psbuiIdNuGet package
The psbuiId NuGet package was found to contain malicious code. This discovery was credited to the OpenSSF's malicious-packages project, which maintains a catalog of known malicious software packages across multiple ecosystems.\n\nThe incident was tracked under the identifier MAL-2024-4618 and reported via GitHub Advisory GHSA-hg9x-84fp-2vp6. The package was classified as critical severity due to the presence of malicious code.\n\nUsers of the psbuiId package should immediately identify and remove affected versions from their environments.
Indicators of compromise
- Packages
- psbuiId
Remediation
- Remove all versions of psbuiId from affected projects
- Audit systems that may have executed code from psbuiId for signs of compromise
- Review NuGet package dependencies for any reliance on psbuiId
- Monitor for any suspicious activity on systems that previously used this package
Sources
- GitHub Advisory GHSA-hg9x-84fp-2vp6 · GitHub Advisory Database
Cite this entry
"Malicious code in psbuiId (NuGet)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malicious-code-in-psbuiid-nuget-bdt72h
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in Reactive.GUI.Winforms (NuGet)
Malicious code was discovered in the Reactive.GUI.Winforms NuGet package. The package was identified by the OpenSSF malicious packages project and reported via GitHub Advisory GHSA-45h9-gh73-7ghq.
NuGetCompromised package - resolvedcritical
Malicious code in PubIishIgnore (NuGet)
Malicious code was discovered in the PubIishIgnore NuGet package. The package contained intentional malicious functionality and was flagged by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in stripeapi.net (NuGet)
Malicious code was discovered in multiple versions of the stripeapi.net NuGet package. The incident was identified and documented by the OpenSSF malicious-packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Zendesk.Client (NuGet)
Malicious code was discovered in the Zendesk.Client NuGet package. The OpenSSF malicious packages project identified and documented the incident under MAL-2024-4709.
NuGetCompromised package