Malicious code in vspropertypages (NuGet)
Malicious code was discovered in the vspropertypages NuGet package. The OpenSSF identified and documented the malicious package as part of their malicious-packages repository.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of affected versions
- Ecosystems
- Attack vectors
- Affected entities
- vspropertypagesNuGet package
The vspropertypages NuGet package was found to contain malicious code. The discovery was credited to the OpenSSF (Open Source Security Foundation), which maintains a repository of known malicious packages for security research and awareness purposes.\n\nThe incident was documented in the OpenSSF's malicious-packages repository under identifier MAL-2026-7451 and reported via GitHub Security Advisory GHSA-4xrc-3xx8-5fh3.\n\nDevelopers who have installed or depend on vspropertypages should review their supply chain and remove or update affected versions.
Indicators of compromise
- Packages
- vspropertypages
Remediation
- Remove or uninstall the vspropertypages package from affected projects
- Review project dependencies and supply chain for other potentially compromised packages
- Audit systems that may have executed code from affected versions
- Update to a patched or alternative package if available
- Monitor NuGet package feeds and security advisories for updates
Sources
- GitHub Advisory GHSA-4xrc-3xx8-5fh3 · GitHub Advisory Database
Cite this entry
"Malicious code in vspropertypages (NuGet)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malicious-code-in-vspropertypages-nuget-1b1vov
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in intercom-php (Packagist)
The intercom-php package on Packagist was compromised with malicious code as part of the Mini Shai-Hulud campaign by the TeamPCP threat actor. The malicious payload steals credentials and can propagate to NPM packages using discovered credentials.
Mini Shai HuludTeamPCPNuGetCompromised packageMalicious maintainer - resolvedcritical
Malicious code in Ultimate.Wpf.Toolkit (NuGet)
Multiple versions of the Ultimate.Wpf.Toolkit NuGet package contained malicious code. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in YoutubeExtractor.Net (NuGet)
Malicious code was discovered in the YoutubeExtractor.Net NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Zendesk.OAuth (NuGet)
Malicious code was discovered in multiple versions of the Zendesk.OAuth NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package