Malicious code in Superpower-Api (NuGet)
Malicious code was discovered in the Superpower-Api NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
- Disclosed
- Last updated
- Blast radius
- All users of affected Superpower-Api NuGet package versions
- Ecosystems
- Attack vectors
- Affected entities
- Superpower-ApiNuGet package
A malicious code injection was identified in the Superpower-Api package distributed via NuGet. The vulnerability was detected and cataloged by the OpenSSF's malicious packages initiative, which maintains a repository of known malicious software supply chain incidents.\n\nThe package was flagged as containing malicious code, indicating a compromise of the package itself rather than a legitimate vulnerability in the software. This represents a direct supply chain attack vector affecting all consumers of the compromised package versions.\n\nThe incident was disclosed on July 20, 2026, and documented under OpenSSF reference MAL-2024-4665.
Indicators of compromise
- Packages
- Superpower-Api
Remediation
- Remove or uninstall the Superpower-Api NuGet package from all affected systems
- Audit systems that may have installed or executed code from this package
- Review package dependencies and replace with legitimate alternatives if available
- Monitor for any suspicious activity on systems that may have been affected
- Update to a clean version of the package if a remediated version is released, or use an alternative package
Sources
- GitHub Advisory GHSA-x2x2-8r6x-xxjq · GitHub Advisory Database
Cite this entry
"Malicious code in Superpower-Api (NuGet)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malicious-code-in-superpower-api-nuget-qdsyw6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in Ultimate.Wpf.Toolkit (NuGet)
Multiple versions of the Ultimate.Wpf.Toolkit NuGet package contained malicious code. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in YoutubeExtractor.Net (NuGet)
Malicious code was discovered in the YoutubeExtractor.Net NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Zendesk.OAuth (NuGet)
Malicious code was discovered in multiple versions of the Zendesk.OAuth NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Winforms (NuGet)
Malicious code was discovered in multiple versions of the Winforms package on NuGet. The incident was documented by the OpenSSF malicious packages project and published as GitHub advisory GHSA-wq82-5xjm-57wq.
NuGetCompromised package