Malicious code in WpfScreenHelper.Net (NuGet)
Malicious code was discovered in the WpfScreenHelper.Net NuGet package. The package was compromised and distributed with malicious payload. The incident was identified and documented by the OpenSSF malicious packages project.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of affected versions
- Ecosystems
- Attack vectors
- Affected entities
- WpfScreenHelper.NetNuGet package
WpfScreenHelper.Net, a NuGet package, was found to contain malicious code. The compromise was identified and credited to the OpenSSF's malicious packages tracking initiative.\n\nThe malicious package was published to the NuGet package repository, potentially exposing any developers or applications that installed the affected versions to the embedded malicious code.\n\nThis incident has been cataloged in the OpenSSF malicious packages database (MAL-2024-4702) and is tracked via GitHub Advisory GHSA-q3wx-7x28-wr2m.
Indicators of compromise
- Packages
- WpfScreenHelper.Net
Remediation
- Remove WpfScreenHelper.Net from affected projects immediately
- Audit project dependencies and build artifacts for any signs of compromise
- Review and rotate any credentials or secrets that may have been exposed
- Update to a clean, verified version of the package if available, or identify a safe alternative
- Monitor systems for any suspicious activity related to the malicious payload
Sources
- GitHub Advisory GHSA-q3wx-7x28-wr2m · GitHub Advisory Database
Cite this entry
"Malicious code in WpfScreenHelper.Net (NuGet)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malicious-code-in-wpfscreenhelper-net-nuget-tak35l
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in Reactive.GUI.Winforms (NuGet)
Malicious code was discovered in the Reactive.GUI.Winforms NuGet package. The package was identified by the OpenSSF malicious packages project and reported via GitHub Advisory GHSA-45h9-gh73-7ghq.
NuGetCompromised package - resolvedcritical
Malicious code in PubIishIgnore (NuGet)
Malicious code was discovered in the PubIishIgnore NuGet package. The package contained intentional malicious functionality and was flagged by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in stripeapi.net (NuGet)
Malicious code was discovered in multiple versions of the stripeapi.net NuGet package. The incident was identified and documented by the OpenSSF malicious-packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Zendesk.Client (NuGet)
Malicious code was discovered in the Zendesk.Client NuGet package. The OpenSSF malicious packages project identified and documented the incident under MAL-2024-4709.
NuGetCompromised package