Malicious code in Tessa.Linux.V2 (NuGet)
Malicious code was discovered in the Tessa.Linux.V2 NuGet package. The package was identified by the OpenSSF malicious packages project and reported via GitHub Security Advisory GHSA-447h-gf6j-f83q.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of affected versions
- Ecosystems
- Attack vectors
- Affected entities
- Tessa.Linux.V2
The Tessa.Linux.V2 package on NuGet was found to contain malicious code. This discovery was credited to the OpenSSF's malicious packages tracking initiative, which maintains a catalog of known malicious software supply chain incidents.\n\nThe advisory was published on July 20, 2026, and assigned GitHub Security Advisory identifier GHSA-447h-gf6j-f83q. The malicious package entry is tracked in the OpenSSF repository under MAL-2024-4679.\n\nAffected users should immediately remove or update the Tessa.Linux.V2 package from their environments.
Indicators of compromise
- Packages
- Tessa.Linux.V2
Remediation
- Remove Tessa.Linux.V2 from all affected projects and dependencies
- Audit systems that may have installed or executed this package
- Check for any suspicious activity or unauthorized access on systems where this package was used
- Monitor for indicators of compromise related to this malicious package
- Use only verified, trusted versions from the official NuGet repository going forward
Sources
- GitHub Advisory GHSA-447h-gf6j-f83q · GitHub Advisory Database
Cite this entry
"Malicious code in Tessa.Linux.V2 (NuGet)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malicious-code-in-tessa-linux-v2-nuget-1vjfka
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in intercom-php (Packagist)
The intercom-php package on Packagist was compromised with malicious code as part of the Mini Shai-Hulud campaign by the TeamPCP threat actor. The malicious payload steals credentials and can propagate to NPM packages using discovered credentials.
Mini Shai HuludTeamPCPNuGetCompromised packageMalicious maintainer - resolvedcritical
Malicious code in Ultimate.Wpf.Toolkit (NuGet)
Multiple versions of the Ultimate.Wpf.Toolkit NuGet package contained malicious code. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in YoutubeExtractor.Net (NuGet)
Malicious code was discovered in the YoutubeExtractor.Net NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Zendesk.OAuth (NuGet)
Malicious code was discovered in multiple versions of the Zendesk.OAuth NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package