Malicious code in security_hacks (NuGet)
Malicious code was discovered in the security_hacks NuGet package. The package was identified by the OpenSSF malicious packages project and reported via GitHub Advisory GHSA-348g-27q2-qxc6.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of affected versions
- Ecosystems
- Attack vectors
- Affected entities
- security_hacks
The security_hacks package on NuGet was found to contain malicious code. The discovery was credited to the OpenSSF's malicious packages initiative, which maintains a repository of known malicious software supply chain incidents.\n\nThe incident was tracked under GitHub Advisory GHSA-348g-27q2-qxc6 and assigned the malicious package identifier MAL-2026-7450. The advisory was published on July 20, 2026.\n\nNo specific technical details about the malicious payload, affected versions, or distribution timeline are provided in the source material.
Indicators of compromise
- Packages
- security_hacks
Remediation
- Remove the security_hacks package from affected environments
- Audit systems that may have installed or executed code from this package
- Review NuGet package dependencies for any reliance on security_hacks
- Monitor for indicators of compromise if the package was previously installed
Sources
- GitHub Advisory GHSA-348g-27q2-qxc6 · GitHub Advisory Database
Cite this entry
"Malicious code in security_hacks (NuGet)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malicious-code-in-security-hacks-nuget-14c1c2
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in intercom-php (Packagist)
The intercom-php package on Packagist was compromised with malicious code as part of the Mini Shai-Hulud campaign by the TeamPCP threat actor. The malicious payload steals credentials and can propagate to NPM packages using discovered credentials.
Mini Shai HuludTeamPCPNuGetCompromised packageMalicious maintainer - resolvedcritical
Malicious code in Ultimate.Wpf.Toolkit (NuGet)
Multiple versions of the Ultimate.Wpf.Toolkit NuGet package contained malicious code. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in YoutubeExtractor.Net (NuGet)
Malicious code was discovered in the YoutubeExtractor.Net NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Zendesk.OAuth (NuGet)
Malicious code was discovered in multiple versions of the Zendesk.OAuth NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package