Malicious code in stripeapi.net (NuGet)
Malicious code was discovered in multiple versions of the stripeapi.net NuGet package. The incident was identified and documented by the OpenSSF malicious-packages project.
- Disclosed
- Last updated
- Blast radius
- Multiple versions of stripeapi.net package on NuGet; impact scope depends on adoption and deployment of affected versions.
- Ecosystems
- Attack vectors
- Affected entities
- stripeapi.netNuGet package containing malicious code
The stripeapi.net package on NuGet was found to contain malicious code across multiple versions. This incident was identified and credited to the OpenSSF's malicious-packages project, which maintains a public repository of known malicious package incidents.\n\nThe package appears to have been compromised, with malicious versions published to the NuGet package registry. The OpenSSF documentation (MAL-2026-1889) provides the authoritative record of affected versions.\n\nUsers of the stripeapi.net package should immediately audit their dependencies and remove or update to a known-clean version if available.
Indicators of compromise
- Packages
- stripeapi.net
Remediation
- Identify all systems and projects using stripeapi.net from NuGet
- Remove or uninstall affected versions of stripeapi.net
- Audit systems that may have executed code from compromised versions for signs of compromise
- Update to a patched or alternative version if available
- Review NuGet package security advisories for stripeapi.net regularly
- Consider using package verification and signing checks in your build pipeline
Sources
- GitHub Advisory GHSA-v22p-9fwv-76r7 · GitHub Advisory Database
Cite this entry
"Malicious code in stripeapi.net (NuGet)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malicious-code-in-stripeapi-net-nuget-1d222m
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in Ultimate.Wpf.Toolkit (NuGet)
Multiple versions of the Ultimate.Wpf.Toolkit NuGet package contained malicious code. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in YoutubeExtractor.Net (NuGet)
Malicious code was discovered in the YoutubeExtractor.Net NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Zendesk.OAuth (NuGet)
Malicious code was discovered in multiple versions of the Zendesk.OAuth NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Winforms (NuGet)
Malicious code was discovered in multiple versions of the Winforms package on NuGet. The incident was documented by the OpenSSF malicious packages project and published as GitHub advisory GHSA-wq82-5xjm-57wq.
NuGetCompromised package