Malicious code in Tessa.Analyzer (NuGet)
Malicious code was discovered in the Tessa.Analyzer NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of affected versions
- Ecosystems
- Attack vectors
- Affected entities
- Tessa.AnalyzerNuGet package
Malicious code was found in the Tessa.Analyzer package distributed via NuGet. The vulnerability was identified and cataloged by the OpenSSF's malicious packages initiative, which tracks confirmed supply chain compromises.\n\nThe package was published on the NuGet package manager, making it available to .NET developers. The malicious code represents a direct compromise of the package supply chain.\n\nUsers of Tessa.Analyzer should immediately cease use of affected versions and verify their systems for any signs of compromise. The OpenSSF malicious packages repository provides additional technical details under identifier MAL-2024-4676.
Indicators of compromise
- Packages
- Tessa.Analyzer
Remediation
- Remove Tessa.Analyzer from all projects and dependencies
- Audit systems that may have executed code from affected versions
- Review NuGet package history and remove any suspicious packages
- Implement package verification and scanning in your build pipeline
- Monitor for indicators of compromise from systems that may have used this package
Sources
- GitHub Advisory GHSA-383m-wq9q-v94h · GitHub Advisory Database
Cite this entry
"Malicious code in Tessa.Analyzer (NuGet)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malicious-code-in-tessa-analyzer-nuget-1xmb3q
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in Ultimate.Wpf.Toolkit (NuGet)
Multiple versions of the Ultimate.Wpf.Toolkit NuGet package contained malicious code. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in YoutubeExtractor.Net (NuGet)
Malicious code was discovered in the YoutubeExtractor.Net NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Zendesk.OAuth (NuGet)
Malicious code was discovered in multiple versions of the Zendesk.OAuth NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Winforms (NuGet)
Malicious code was discovered in multiple versions of the Winforms package on NuGet. The incident was documented by the OpenSSF malicious packages project and published as GitHub advisory GHSA-wq82-5xjm-57wq.
NuGetCompromised package