Malicious code in xopxopxopxopxopx (NuGet)
Malicious code was discovered in the xopxopxopxopxopx NuGet package. The package was identified and reported by the OpenSSF malicious packages project.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on package adoption and versions affected
- Ecosystems
- Attack vectors
- Affected entities
- xopxopxopxopxopxNuGet package
A NuGet package named xopxopxopxopxopx was found to contain malicious code. The discovery was credited to the OpenSSF (Open Source Security Foundation) and documented in their malicious packages repository under identifier MAL-2024-4705.\n\nThe package was published on GitHub's advisory feed on 2026-07-20 and classified as critical severity. The malicious package has been identified and cataloged as part of the OpenSSF's ongoing efforts to track and document malicious software in public package repositories.
Indicators of compromise
- Packages
- xopxopxopxopxopx
Remediation
- Remove the xopxopxopxopxopx package from all projects and dependencies
- Audit project history for any versions of xopxopxopxopxopx that may have been installed
- Review and rotate any credentials or secrets that may have been exposed if the malicious code executed
- Update to a safe alternative package if one exists, or implement the required functionality directly
Sources
- GitHub Advisory GHSA-jmg2-xjqm-j949 · GitHub Advisory Database
Cite this entry
"Malicious code in xopxopxopxopxopx (NuGet)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malicious-code-in-xopxopxopxopxopx-nuget-tlq1qz
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in intercom-php (Packagist)
The intercom-php package on Packagist was compromised with malicious code as part of the Mini Shai-Hulud campaign by the TeamPCP threat actor. The malicious payload steals credentials and can propagate to NPM packages using discovered credentials.
Mini Shai HuludTeamPCPNuGetCompromised packageMalicious maintainer - resolvedcritical
Malicious code in Ultimate.Wpf.Toolkit (NuGet)
Multiple versions of the Ultimate.Wpf.Toolkit NuGet package contained malicious code. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in YoutubeExtractor.Net (NuGet)
Malicious code was discovered in the YoutubeExtractor.Net NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package - resolvedcritical
Malicious code in Zendesk.OAuth (NuGet)
Malicious code was discovered in multiple versions of the Zendesk.OAuth NuGet package. The incident was identified and documented by the OpenSSF malicious packages project.
NuGetCompromised package