# GitHub Advisory backfill: about 264 NuGet malware packages flagged > On 2026-07-20 GitHub's Advisory Database published a ~264-package NuGet CWE-506 malware backfill - the largest single-day NuGet sweep on record. Dominant themes: Solana/crypto wallet impersonators (~15 packages: `Solana`, `SolanaWallet`, `solananet`, `solnetplus`, `solnetall`, `solnetunified`, `solnetwallet.net.core`), WPF/WinForms UI-kit typosquats (~40 packages: `WPF-UI-Net`, `WpfAnimatedGif.Net`, `WpfLightToolkit.Net`, `LiveCharts.net`, `Bunifu.*`), Oracle Cloud SDK impersonators (`OCI.DotNetSDK.*`, ~25 packages), and crypto-exchange API impersonators (`Binance`, `Kucoin`, `Kraken`, `Bybit`, `Coinbase`, `Huobi`, `Ripple`). - Published: 2026-07-20 - Severity: high - Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole. - Ecosystems: NuGet - Scope: 174 packages, 0 compromised versions - Tags: typosquat, crypto-wallet-drain, credential-theft, dependency-confusion - Also known as: 2026-07-20 GHSA NuGet backfill, NuGet Solana wallet typosquat sweep, NuGet WPF/WinForms UI typosquat sweep, NuGet Oracle OCI SDK typosquat sweep - Detected by: GitHub Advisory Database, OpenSSF Package Analysis, NuGet Security - Incident ID: nuget-2026-07-20-ghsa-backfill-sweep ## Affected packages (174) Only the exact versions listed were named by the source advisories. Other versions are not implicated. | Package | Ecosystem | Compromised versions | |---|---|---| | [AlgoTrading](https://dependencywatch.io/package/nuget/AlgoTrading) | NuGet | | | [AlgoTrading.Net](https://dependencywatch.io/package/nuget/AlgoTrading.Net) | NuGet | | | [Altcoins](https://dependencywatch.io/package/nuget/Altcoins) | NuGet | | | [Altcoins.Library](https://dependencywatch.io/package/nuget/Altcoins.Library) | NuGet | | | [binance.csharp](https://dependencywatch.io/package/nuget/binance.csharp) | NuGet | | | [Binance.Libary](https://dependencywatch.io/package/nuget/Binance.Libary) | NuGet | | | [Binance.Library](https://dependencywatch.io/package/nuget/Binance.Library) | NuGet | | | [bitcoincore](https://dependencywatch.io/package/nuget/bitcoincore) | NuGet | | | [BitcoinLib.Net](https://dependencywatch.io/package/nuget/BitcoinLib.Net) | NuGet | | | [Blazor.Captcha](https://dependencywatch.io/package/nuget/Blazor.Captcha) | NuGet | | | [Blockcore.Networks.Bitcoin.Bc](https://dependencywatch.io/package/nuget/Blockcore.Networks.Bitcoin.Bc) | NuGet | | | [bsure.binsec](https://dependencywatch.io/package/nuget/bsure.binsec) | NuGet | | | [bsure.utils](https://dependencywatch.io/package/nuget/bsure.utils) | NuGet | | | [Bunifu](https://dependencywatch.io/package/nuget/Bunifu) | NuGet | | | [Bunifu.Form](https://dependencywatch.io/package/nuget/Bunifu.Form) | NuGet | | | [Bunifu.GUI](https://dependencywatch.io/package/nuget/Bunifu.GUI) | NuGet | | | [Bunifu.UI.WinForms.Net](https://dependencywatch.io/package/nuget/Bunifu.UI.WinForms.Net) | NuGet | | | [Bunifu.UI2Winforms](https://dependencywatch.io/package/nuget/Bunifu.UI2Winforms) | NuGet | | | [Bunifu.UI3Winforms](https://dependencywatch.io/package/nuget/Bunifu.UI3Winforms) | NuGet | | | [Bybit.Net.Core](https://dependencywatch.io/package/nuget/Bybit.Net.Core) | NuGet | | | [CaptchaCsharp](https://dependencywatch.io/package/nuget/CaptchaCsharp) | NuGet | | | [CefSharp.WinForm.Net.Core](https://dependencywatch.io/package/nuget/CefSharp.WinForm.Net.Core) | NuGet | | | [Chronos.Platform.Linux.API](https://dependencywatch.io/package/nuget/Chronos.Platform.Linux.API) | NuGet | | | [Clipboard.net](https://dependencywatch.io/package/nuget/Clipboard.net) | NuGet | | | [CodeExecTest](https://dependencywatch.io/package/nuget/CodeExecTest) | NuGet | | | [Coinbase.Api](https://dependencywatch.io/package/nuget/Coinbase.Api) | NuGet | | | [GetRekt420](https://dependencywatch.io/package/nuget/GetRekt420) | NuGet | | | [GoogleReCaptcha.V4](https://dependencywatch.io/package/nuget/GoogleReCaptcha.V4) | NuGet | | | [hackney.core.enums](https://dependencywatch.io/package/nuget/hackney.core.enums) | NuGet | | | [hackney.core.jwt](https://dependencywatch.io/package/nuget/hackney.core.jwt) | NuGet | | | [Huobi.Net.Core](https://dependencywatch.io/package/nuget/Huobi.Net.Core) | NuGet | | | [jjrawlins.cdkiampolicybuilderhelper](https://dependencywatch.io/package/nuget/jjrawlins.cdkiampolicybuilderhelper) | NuGet | | | [KANYEWESTBRIDGADE](https://dependencywatch.io/package/nuget/KANYEWESTBRIDGADE) | NuGet | | | [KanyeWestBrigade](https://dependencywatch.io/package/nuget/KanyeWestBrigade) | NuGet | | | [KanyeWestWasRight](https://dependencywatch.io/package/nuget/KanyeWestWasRight) | NuGet | | | [KeyAuthAPI](https://dependencywatch.io/package/nuget/KeyAuthAPI) | NuGet | | | [KrakenExchange.Net.Core](https://dependencywatch.io/package/nuget/KrakenExchange.Net.Core) | NuGet | | | [Kucoin.Net.Core](https://dependencywatch.io/package/nuget/Kucoin.Net.Core) | NuGet | | | [LedgerWallet.Net](https://dependencywatch.io/package/nuget/LedgerWallet.Net) | NuGet | | | [Lfafafa2](https://dependencywatch.io/package/nuget/Lfafafa2) | NuGet | | | [Lfafafa3](https://dependencywatch.io/package/nuget/Lfafafa3) | NuGet | | | [Lib.Harmony.net](https://dependencywatch.io/package/nuget/Lib.Harmony.net) | NuGet | | | [LibEmbedder.Fody](https://dependencywatch.io/package/nuget/LibEmbedder.Fody) | NuGet | | | [Litecoin](https://dependencywatch.io/package/nuget/Litecoin) | NuGet | | | [Live.Charts.WinForm](https://dependencywatch.io/package/nuget/Live.Charts.WinForm) | NuGet | | | [LiveCharts.net](https://dependencywatch.io/package/nuget/LiveCharts.net) | NuGet | | | [LiveCharts.WinForms.net](https://dependencywatch.io/package/nuget/LiveCharts.WinForms.net) | NuGet | | | [LiveCharts.Wpf.net](https://dependencywatch.io/package/nuget/LiveCharts.Wpf.net) | NuGet | | | [MailBee](https://dependencywatch.io/package/nuget/MailBee) | NuGet | | | [markdown-to-html](https://dependencywatch.io/package/nuget/markdown-to-html) | NuGet | | | [MetroModern.UI2](https://dependencywatch.io/package/nuget/MetroModern.UI2) | NuGet | | | [nethereumunified](https://dependencywatch.io/package/nuget/nethereumunified) | NuGet | | | [NotifyIcons](https://dependencywatch.io/package/nuget/NotifyIcons) | NuGet | | | [Notus.Wallet.Utility.Net](https://dependencywatch.io/package/nuget/Notus.Wallet.Utility.Net) | NuGet | | | [Nughettt.TestPO](https://dependencywatch.io/package/nuget/Nughettt.TestPO) | NuGet | | | [OCI.DotNetSDK.Ai.speech](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Ai.speech) | NuGet | | | [OCI.DotNetSDK.Ai.vision](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Ai.vision) | NuGet | | | [OCI.DotNetSDK.Apm.config](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Apm.config) | NuGet | | | [OCI.DotNetSDK.Appmgmtcontrol.Net](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Appmgmtcontrol.Net) | NuGet | | | [OCI.DotNetSDK.Certificates.Net](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Certificates.Net) | NuGet | | | [OCI.DotNetSDK.Certificatesmanagement.Net](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Certificatesmanagement.Net) | NuGet | | | [OCI.DotNetSDK.Dashboard.service](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Dashboard.service) | NuGet | | | [OCI.DotNetSDK.Databasetools.Net](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Databasetools.Net) | NuGet | | | [OCI.DotNetSDK.Datalabeling.service](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Datalabeling.service) | NuGet | | | [OCI.DotNetSDK.File.storage](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.File.storage) | NuGet | | | [OCI.DotNetSDK.Net](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Net) | NuGet | | | [OCI.DotNetSDK.Ospgateway.Net](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Ospgateway.Net) | NuGet | | | [OCI.DotNetSDK.Osubbillingschedule.Net](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Osubbillingschedule.Net) | NuGet | | | [OCI.DotNetSDK.Osuborganizationsubscription.Net](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Osuborganizationsubscription.Net) | NuGet | | | [OCI.DotNetSDK.Osubsubscription.Net](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Osubsubscription.Net) | NuGet | | | [OCI.DotNetSDK.Osubusage.Net](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Osubusage.Net) | NuGet | | | [OCI.DotNetSDK.Servicemanager.proxy](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Servicemanager.proxy) | NuGet | | | [OCI.DotNetSDK.Threat.intelligence](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Threat.intelligence) | NuGet | | | [OCI.DotNetSDK.Usage.Net](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Usage.Net) | NuGet | | | [OCI.DotNetSDK.Visualbuilder.Net](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Visualbuilder.Net) | NuGet | | | [OCI.DotNetSDK.Waf.Net](https://dependencywatch.io/package/nuget/OCI.DotNetSDK.Waf.Net) | NuGet | | | [OpenCvSharp4.WpfExtensions.Net](https://dependencywatch.io/package/nuget/OpenCvSharp4.WpfExtensions.Net) | NuGet | | | [OtpCsharp](https://dependencywatch.io/package/nuget/OtpCsharp) | NuGet | | | [Pathoschild.Stardew.Mod.Build.Config](https://dependencywatch.io/package/nuget/Pathoschild.Stardew.Mod.Build.Config) | NuGet | | | [Pathoschild.Stardew.ModBuildConfig.Net](https://dependencywatch.io/package/nuget/Pathoschild.Stardew.ModBuildConfig.Net) | NuGet | | | [PayPalMerchant.SDK](https://dependencywatch.io/package/nuget/PayPalMerchant.SDK) | NuGet | | | [PDFTron.NETCore.Windows.x64.Net](https://dependencywatch.io/package/nuget/PDFTron.NETCore.Windows.x64.Net) | NuGet | | | [Portable.Xaml.Net](https://dependencywatch.io/package/nuget/Portable.Xaml.Net) | NuGet | | | [ppy.osu.Game.Lib](https://dependencywatch.io/package/nuget/ppy.osu.Game.Lib) | NuGet | | | [PrivacyGate.net](https://dependencywatch.io/package/nuget/PrivacyGate.net) | NuGet | | | [psbuiId](https://dependencywatch.io/package/nuget/psbuiId) | NuGet | | | [PubIishIgnore](https://dependencywatch.io/package/nuget/PubIishIgnore) | NuGet | | | [PublishIgnor](https://dependencywatch.io/package/nuget/PublishIgnor) | NuGet | | | [RadPdf.Net](https://dependencywatch.io/package/nuget/RadPdf.Net) | NuGet | | | [Reactive.GUI.Winforms](https://dependencywatch.io/package/nuget/Reactive.GUI.Winforms) | NuGet | | | [ReaLTaiizor-WinForm](https://dependencywatch.io/package/nuget/ReaLTaiizor-WinForm) | NuGet | | | [Reddit.api](https://dependencywatch.io/package/nuget/Reddit.api) | NuGet | | | [Reothor.Lab.EvilPackage](https://dependencywatch.io/package/nuget/Reothor.Lab.EvilPackage) | NuGet | | | [Resource.Embedder.Net](https://dependencywatch.io/package/nuget/Resource.Embedder.Net) | NuGet | | | [Rg.Plugins.Popups.Net](https://dependencywatch.io/package/nuget/Rg.Plugins.Popups.Net) | NuGet | | | [Rimworld.Reference.Libary](https://dependencywatch.io/package/nuget/Rimworld.Reference.Libary) | NuGet | | | [Rimworld.References.Net](https://dependencywatch.io/package/nuget/Rimworld.References.Net) | NuGet | | | [Ripple.NetCore.Api](https://dependencywatch.io/package/nuget/Ripple.NetCore.Api) | NuGet | | | [Rockstar.AssetManager.Infrastructure](https://dependencywatch.io/package/nuget/Rockstar.AssetManager.Infrastructure) | NuGet | | | [RSG.Base](https://dependencywatch.io/package/nuget/RSG.Base) | NuGet | | | [Sanka.UI.WinForms](https://dependencywatch.io/package/nuget/Sanka.UI.WinForms) | NuGet | | | [Sanka.UI2.WinForms](https://dependencywatch.io/package/nuget/Sanka.UI2.WinForms) | NuGet | | | [Sanka.UI3.WinForms](https://dependencywatch.io/package/nuget/Sanka.UI3.WinForms) | NuGet | | | [security_hacks](https://dependencywatch.io/package/nuget/security_hacks) | NuGet | | | [seedefender](https://dependencywatch.io/package/nuget/seedefender) | NuGet | | | [Shade.UI.WinForms](https://dependencywatch.io/package/nuget/Shade.UI.WinForms) | NuGet | | | [Shade.WPF.Controls](https://dependencywatch.io/package/nuget/Shade.WPF.Controls) | NuGet | | | [SharpCashAddr.Core](https://dependencywatch.io/package/nuget/SharpCashAddr.Core) | NuGet | | | [sharpdefender](https://dependencywatch.io/package/nuget/sharpdefender) | NuGet | | | [Simplify.Windows.Forms.Net](https://dependencywatch.io/package/nuget/Simplify.Windows.Forms.Net) | NuGet | | | [Skylark.Net](https://dependencywatch.io/package/nuget/Skylark.Net) | NuGet | | | [Soenneker.Redis.Util.Net](https://dependencywatch.io/package/nuget/Soenneker.Redis.Util.Net) | NuGet | | | [Solana](https://dependencywatch.io/package/nuget/Solana) | NuGet | | | [solananet](https://dependencywatch.io/package/nuget/solananet) | NuGet | | | [SolanaWallet](https://dependencywatch.io/package/nuget/SolanaWallet) | NuGet | | | [solnetall](https://dependencywatch.io/package/nuget/solnetall) | NuGet | | | [solnetall.net](https://dependencywatch.io/package/nuget/solnetall.net) | NuGet | | | [solnetplus](https://dependencywatch.io/package/nuget/solnetplus) | NuGet | | | [solnetunified](https://dependencywatch.io/package/nuget/solnetunified) | NuGet | | | [solnetwallet.net.core](https://dependencywatch.io/package/nuget/solnetwallet.net.core) | NuGet | | | [sqzrframework480](https://dependencywatch.io/package/nuget/sqzrframework480) | NuGet | | | [Stl.Blazor.Authentication.Net](https://dependencywatch.io/package/nuget/Stl.Blazor.Authentication.Net) | NuGet | | | [Stl.CommandLine.Net](https://dependencywatch.io/package/nuget/Stl.CommandLine.Net) | NuGet | | | [Stl.Fusion.Ext.Contracts.Net](https://dependencywatch.io/package/nuget/Stl.Fusion.Ext.Contracts.Net) | NuGet | | | [Stl.Fusion.Ext.Services.Net](https://dependencywatch.io/package/nuget/Stl.Fusion.Ext.Services.Net) | NuGet | | | [Stl.Generators.Net](https://dependencywatch.io/package/nuget/Stl.Generators.Net) | NuGet | | | [Stl.Plugins.Extensions.Net](https://dependencywatch.io/package/nuget/Stl.Plugins.Extensions.Net) | NuGet | | | [Stl.RestEase.Net](https://dependencywatch.io/package/nuget/Stl.RestEase.Net) | NuGet | | | [Stl.Rpc.Server.Core](https://dependencywatch.io/package/nuget/Stl.Rpc.Server.Core) | NuGet | | | [Stl.Rpc.Server.Net.Fx](https://dependencywatch.io/package/nuget/Stl.Rpc.Server.Net.Fx) | NuGet | | | [stripeapi.net](https://dependencywatch.io/package/nuget/stripeapi.net) | NuGet | | | [Superpower-Api](https://dependencywatch.io/package/nuget/Superpower-Api) | NuGet | | | [Syntellect.Winium.Cruciatus.Net](https://dependencywatch.io/package/nuget/Syntellect.Winium.Cruciatus.Net) | NuGet | | | [Syntellect.Winium.Element](https://dependencywatch.io/package/nuget/Syntellect.Winium.Element) | NuGet | | | [Syntellect.Winium.Web.Driver](https://dependencywatch.io/package/nuget/Syntellect.Winium.Web.Driver) | NuGet | | | [Tessa.Analyzer](https://dependencywatch.io/package/nuget/Tessa.Analyzer) | NuGet | | | [Tessa.Compilations](https://dependencywatch.io/package/nuget/Tessa.Compilations) | NuGet | | | [Tessa.Core](https://dependencywatch.io/package/nuget/Tessa.Core) | NuGet | | | [Tessa.Linux.V2](https://dependencywatch.io/package/nuget/Tessa.Linux.V2) | NuGet | | | [Tessa.Net.V2](https://dependencywatch.io/package/nuget/Tessa.Net.V2) | NuGet | | | [Tessa.Postgre.Sql](https://dependencywatch.io/package/nuget/Tessa.Postgre.Sql) | NuGet | | | [Tessa.Server.Net](https://dependencywatch.io/package/nuget/Tessa.Server.Net) | NuGet | | | [Tessa.UI2](https://dependencywatch.io/package/nuget/Tessa.UI2) | NuGet | | | [Tessa.Web.Client.Net](https://dependencywatch.io/package/nuget/Tessa.Web.Client.Net) | NuGet | | | [Tessa.Web.Core](https://dependencywatch.io/package/nuget/Tessa.Web.Core) | NuGet | | | [Tessa.Windows.V2](https://dependencywatch.io/package/nuget/Tessa.Windows.V2) | NuGet | | | [test6789.client](https://dependencywatch.io/package/nuget/test6789.client) | NuGet | | | [test6789.latest](https://dependencywatch.io/package/nuget/test6789.latest) | NuGet | | | [test6789.v3](https://dependencywatch.io/package/nuget/test6789.v3) | NuGet | | | [testt22esttest](https://dependencywatch.io/package/nuget/testt22esttest) | NuGet | | | [TheOpenAI.API](https://dependencywatch.io/package/nuget/TheOpenAI.API) | NuGet | | | [UI2.Guna.Winforms](https://dependencywatch.io/package/nuget/UI2.Guna.Winforms) | NuGet | | | [Ultimate.Wpf.Toolkit](https://dependencywatch.io/package/nuget/Ultimate.Wpf.Toolkit) | NuGet | | | [vspropertypages](https://dependencywatch.io/package/nuget/vspropertypages) | NuGet | | | [Whatsapp.API](https://dependencywatch.io/package/nuget/Whatsapp.API) | NuGet | | | [WindowsAPICodePack.Net](https://dependencywatch.io/package/nuget/WindowsAPICodePack.Net) | NuGet | | | [Winforms](https://dependencywatch.io/package/nuget/Winforms) | NuGet | | | [WPF-UI-Net](https://dependencywatch.io/package/nuget/WPF-UI-Net) | NuGet | | | [Wpf.UI.WinForms](https://dependencywatch.io/package/nuget/Wpf.UI.WinForms) | NuGet | | | [WpfAnimatedGif.Net](https://dependencywatch.io/package/nuget/WpfAnimatedGif.Net) | NuGet | | | [WpfLightToolkit.Net](https://dependencywatch.io/package/nuget/WpfLightToolkit.Net) | NuGet | | | [WPFMediaKit.Net](https://dependencywatch.io/package/nuget/WPFMediaKit.Net) | NuGet | | | [WpfScreenHelper.Net](https://dependencywatch.io/package/nuget/WpfScreenHelper.Net) | NuGet | | | [wpfuihelpercore](https://dependencywatch.io/package/nuget/wpfuihelpercore) | NuGet | | | [Xam.Plugins.Forms.Svg.Net](https://dependencywatch.io/package/nuget/Xam.Plugins.Forms.Svg.Net) | NuGet | | | [XboxGamebar](https://dependencywatch.io/package/nuget/XboxGamebar) | NuGet | | | [xopxopxopxopxopx](https://dependencywatch.io/package/nuget/xopxopxopxopxopx) | NuGet | | | [YoutubeExtractor.Net](https://dependencywatch.io/package/nuget/YoutubeExtractor.Net) | NuGet | | | [Zendesk](https://dependencywatch.io/package/nuget/Zendesk) | NuGet | | | [Zendesk-Api](https://dependencywatch.io/package/nuget/Zendesk-Api) | NuGet | | | [Zendesk.Client](https://dependencywatch.io/package/nuget/Zendesk.Client) | NuGet | | | [Zendesk.Drivers](https://dependencywatch.io/package/nuget/Zendesk.Drivers) | NuGet | | | [Zendesk.OAuth](https://dependencywatch.io/package/nuget/Zendesk.OAuth) | NuGet | | | [ZendeskApi.Client.V2](https://dependencywatch.io/package/nuget/ZendeskApi.Client.V2) | NuGet | | ## What happened On 2026-07-20 GitHub's Advisory Database published **~264 CWE-506 (Embedded Malicious Code) advisories against NuGet packages** in a single-day sweep - the largest single-day NuGet malware batch on record. Every record uses the standard "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" boilerplate. The 264-package count and the specific mix of long-established typosquat targets (`Solnet`, `LiveCharts`, `WpfAnimatedGif`, `Nethereum`, `Bunifu`, `OCI.DotNetSDK`) reads as a **GHSA / OpenSSF backfill import** - GitHub retroactively cataloguing pre-existing NuGet malware that had been detected elsewhere (OpenSSF Package Analysis dataset, Microsoft Defender for Cloud NuGet feed, or a similar tracker) rather than reflecting a single 2026-07-20 attacker action. Regardless of when the packages first shipped to nuget.org, the advisories became authoritative on 2026-07-20 and lockfile-lookup coverage is now available to defenders. ## Cluster 1 - Solana / crypto wallet impersonator cluster (~15 packages) Targets .NET developers integrating Solana / Ethereum / Bitcoin / Litecoin wallet functionality - typosquats and near-name matches of the legitimate `Solnet` (Solana .NET SDK), `Nethereum` (Ethereum .NET SDK), and `NBitcoin`/`BitcoinLib` (Bitcoin .NET SDKs) packages. Names include `Solana`, `SolanaWallet`, `solananet`, `solnetplus`, `solnetall`, `solnetall.net`, `solnetunified`, `solnetwallet.net.core`, `Notus.Wallet.Utility.Net`, `LedgerWallet.Net`, `nethereumunified`, `Litecoin`, `bitcoincore`, `BitcoinLib.Net`, `SharpCashAddr.Core`. ## Cluster 2 - WPF / WinForms UI-kit typosquat cluster (~40 packages) Impersonates legitimate WPF/WinForms UI toolkits by adding `.Net`, `.Core`, `.WinForms.net`, `.Wpf.net`, or capitalization/hyphen variants to real package names. Notable targets: `WPF-UI-Net` (typosquat of `Wpf-UI`), `Bunifu.*` (multiple typosquats of `Bunifu.UI.WinForms`), `LiveCharts.net`/`LiveCharts.Wpf.net`/`LiveCharts.WinForms.net`/`Live.Charts.WinForm` (all typosquats of `LiveCharts`), `WpfAnimatedGif.Net` (typosquat of `WpfAnimatedGif`), `Sanka.UI*` / `Shade.*` / `MetroModern.UI2` / `ReaLTaiizor-WinForm` variants. Also includes `WindowsAPICodePack.Net`, `WinForms`, `Xam.Plugins.Forms.Svg.Net`, `Rg.Plugins.Popups.Net`, `CefSharp.WinForm.Net.Core`, `OpenCvSharp4.WpfExtensions.Net`, and `Portable.Xaml.Net`. ## Cluster 3 - Oracle Cloud OCI SDK impersonator cluster (~25 packages) Impersonates Oracle's official OCI SDK for .NET namespace `OCI.DotNetSDK.*` by targeting individual OCI service SDKs - cloud AI vision/speech, certificates management, dashboard service, data labelling, file storage, threat intelligence, WAF, service manager, database tools, and OSuB (Oracle Subscription) billing/usage/organization/subscription. Any lockfile hit here means the .NET dev host installed a typosquatted OCI SDK - treat Oracle Cloud credentials accessible from that host as compromised. ## Cluster 4 - Crypto-exchange & popular-API impersonator cluster (~20 packages) - Crypto exchanges: `Binance.Library` / `Binance.Libary` (typo) / `binance.csharp`, `Bybit.Net.Core`, `Kucoin.Net.Core`, `KrakenExchange.Net.Core`, `Huobi.Net.Core`, `Coinbase.Api`, `Ripple.NetCore.Api`. - Payment: `stripeapi.net`, `PayPalMerchant.SDK`. - Popular APIs: `Reddit.api`, `MailBee`, `Whatsapp.API`, `YoutubeExtractor.Net`, `TheOpenAI.API`, `Superpower-Api`. - Zendesk cluster (6 packages): `Zendesk`, `Zendesk-Api`, `Zendesk.Client`, `Zendesk.Drivers`, `Zendesk.OAuth`, `ZendeskApi.Client.V2` - a distinctive multi-name Zendesk-API typosquat squat. - Trading libraries: `AlgoTrading`, `AlgoTrading.Net`, `Altcoins`, `Altcoins.Library`. ## Cluster 5 - Miscellaneous typosquat / research clusters (~40+ packages) - `Stl.*` series (11 packages) - typosquats of the `ActualLab.Fusion` / `Stl.Fusion` framework. - `Tessa.*` series (11 packages) - typosquats of the Tessa document-management platform. - `Syntellect.Winium.*` (4 packages) - typosquats of the Winium UI automation library. - `Pathoschild.Stardew.*` (2 packages) - typosquats of the popular Stardew Valley mod-build-config tool. - Game engine / mod impersonators: `Rockstar.AssetManager.Infrastructure`, `Rimworld.Reference.Libary` (misspelling of `Library`), `Rimworld.References.Net`, `ppy.osu.Game.Lib` (osu! game engine). - Meme / joke names: `KanyeWestBrigade`, `KANYEWESTBRIDGADE` (all-caps duplicate), `KanyeWestWasRight`, `GetRekt420`, `Reothor.Lab.EvilPackage`. - Self-labeled scanner-bait: `security_hacks`, `seedefender`, `sharpdefender`, `KeyAuthAPI`, `sqzrframework480`, `psbuiId` (typosquat of `psbuild`), `PublishIgnor` / `PubIishIgnore` (dep-confusion of `PublishIgnore`). - `hackney.core.enums`, `hackney.core.jwt` (typosquats of the `Hackney.Core` framework). - Test / bulk-published fillers: `test6789.client`, `test6789.latest`, `test6789.v3`, `testt22esttest`, `Lfafafa2`, `Lfafafa3`, `Nughettt.TestPO`, `xopxopxopxopxopx`, `jjrawlins.cdkiampolicybuilderhelper`. ## Registry state All 264 packages appear as unlisted on nuget.org (`listed: false` metadata). Original version tarballs are no longer resolvable via the standard NuGet feed but private NuGet feeds (Artifactory, Azure Artifacts, MyGet, on-prem `nuget.exe push`-based servers) that cached the tarballs during the publish window WILL keep serving the original versions after the public unlist - any lockfile hit must be treated as actionable regardless of what the public feed currently returns. ## Impact - Any host that installed any of the packages below should be treated as fully compromised - every GHSA record uses the boilerplate CWE-506 "rotate all secrets from a different computer" language, and no patched version exists - **Solana / crypto wallet impersonator cluster** (~15 packages): `Solana`, `SolanaWallet`, `solananet`, `solnetplus`, `solnetall`, `solnetall.net`, `solnetunified`, `solnetwallet.net.core`, `Notus.Wallet.Utility.Net`, `LedgerWallet.Net`, `nethereumunified`, `Litecoin`, `bitcoincore`, `BitcoinLib.Net`, `SharpCashAddr.Core`. Targets .NET developers integrating Solana / Ethereum / Bitcoin / Litecoin wallet functionality - typosquats and near-name matches of the legitimate `Solnet`, `Nethereum`, `NBitcoin` packages - **WPF / WinForms UI-kit typosquat cluster** (~40 packages): `WPF-UI-Net`, `WpfAnimatedGif.Net`, `WpfLightToolkit.Net`, `WpfScreenHelper.Net`, `WPFMediaKit.Net`, `wpfuihelpercore`, `Wpf.UI.WinForms`, `Ultimate.Wpf.Toolkit`, `LiveCharts.net`, `LiveCharts.Wpf.net`, `LiveCharts.WinForms.net`, `Live.Charts.WinForm`, `Bunifu`, `Bunifu.Form`, `Bunifu.GUI`, `Bunifu.UI.WinForms.Net`, `Bunifu.UI2Winforms`, `Bunifu.UI3Winforms`, `ReaLTaiizor-WinForm`, `Sanka.UI.WinForms`, `Sanka.UI2.WinForms`, `Sanka.UI3.WinForms`, `Shade.WPF.Controls`, `Shade.UI.WinForms`, `MetroModern.UI2`, `Reactive.GUI.Winforms`, `Simplify.Windows.Forms.Net`, `WindowsAPICodePack.Net`, `WinForms`, `Xam.Plugins.Forms.Svg.Net`, `Rg.Plugins.Popups.Net`, `CefSharp.WinForm.Net.Core`, `OpenCvSharp4.WpfExtensions.Net`, `Portable.Xaml.Net`, `Resource.Embedder.Net`, `UI2.Guna.Winforms`, `Skylark.Net` - impersonates legitimate WPF/WinForms UI toolkits by adding `.Net`/`.Core` suffixes to real package names - **Oracle Cloud OCI SDK impersonator cluster** (~25 packages): `OCI.DotNetSDK.Net`, `OCI.DotNetSDK.Ai.speech`, `OCI.DotNetSDK.Ai.vision`, `OCI.DotNetSDK.Apm.config`, `OCI.DotNetSDK.Appmgmtcontrol.Net`, `OCI.DotNetSDK.Certificates.Net`, `OCI.DotNetSDK.Certificatesmanagement.Net`, `OCI.DotNetSDK.Dashboard.service`, `OCI.DotNetSDK.Databasetools.Net`, `OCI.DotNetSDK.Datalabeling.service`, `OCI.DotNetSDK.File.storage`, `OCI.DotNetSDK.Osubbillingschedule.Net`, `OCI.DotNetSDK.Osubusage.Net`, `OCI.DotNetSDK.Osubsubscription.Net`, `OCI.DotNetSDK.Osuborganizationsubscription.Net`, `OCI.DotNetSDK.Ospgateway.Net`, `OCI.DotNetSDK.Servicemanager.proxy`, `OCI.DotNetSDK.Threat.intelligence`, `OCI.DotNetSDK.Usage.Net`, `OCI.DotNetSDK.Waf.Net`, `OCI.DotNetSDK.Visualbuilder.Net` - impersonates the legitimate Oracle Cloud SDK `OCI.DotNetSDK.*` namespace by targeting individual OCI service SDKs - **Crypto-exchange & payment API impersonator cluster** (~20 packages): `Binance.Library`, `Binance.Libary`, `binance.csharp`, `Bybit.Net.Core`, `Kucoin.Net.Core`, `KrakenExchange.Net.Core`, `Huobi.Net.Core`, `Coinbase.Api`, `Ripple.NetCore.Api`, `stripeapi.net`, `PayPalMerchant.SDK`, `Reddit.api`, `MailBee`, `Whatsapp.API`, `YoutubeExtractor.Net`, `TheOpenAI.API`, `Superpower-Api`, `AlgoTrading`, `AlgoTrading.Net`, `Altcoins`, `Altcoins.Library`, `Zendesk`, `Zendesk-Api`, `Zendesk.Client`, `Zendesk.Drivers`, `Zendesk.OAuth`, `ZendeskApi.Client.V2` - impersonators of major crypto-exchange (Binance, Kucoin, Kraken, Bybit, Coinbase, Huobi, Ripple) and popular API (Zendesk, Stripe, PayPal, Reddit, YouTube, OpenAI, WhatsApp, MailBee) SDKs - **Miscellaneous typosquat / research cluster** (~40+ packages): `Stl.*` series (11 packages: `Stl.Blazor.Authentication.Net`, `Stl.CommandLine.Net`, `Stl.Fusion.Ext.Contracts.Net`, `Stl.Fusion.Ext.Services.Net`, `Stl.Generators.Net`, `Stl.Plugins.Extensions.Net`, `Stl.RestEase.Net`, `Stl.Rpc.Server.Core`, `Stl.Rpc.Server.Net.Fx`), `Tessa.*` series (11 packages), `Syntellect.Winium.*` (4 packages), `Pathoschild.Stardew.*` (2 Stardew Valley mod-build-config typosquats), `Rockstar.AssetManager.Infrastructure`, `Rimworld.Reference.Libary`, `Rimworld.References.Net`, `ppy.osu.Game.Lib` (osu! game engine impersonator), `NotifyIcons`, `PublishIgnor`, `PubIishIgnore`, `psbuiId` (typosquat of `psbuild`), `KanyeWestBrigade`, `KANYEWESTBRIDGADE`, `KanyeWestWasRight`, `GetRekt420`, `hackney.core.enums`, `hackney.core.jwt`, `Lfafafa2`, `Lfafafa3`, `KeyAuthAPI`, `security_hacks`, `seedefender`, `sharpdefender`, `sqzrframework480`, `Reothor.Lab.EvilPackage` - The 264-package single-day count and the specific mix of long-established typosquat targets (`Solnet`, `LiveCharts`, `WpfAnimatedGif`, `Nethereum`, `Bunifu`, `OCI.DotNetSDK`) makes this look like a **GHSA / OpenSSF backfill import** - GitHub retroactively cataloguing pre-existing NuGet malware from another feed rather than reflecting a single 2026-07-20 attacker action. Regardless of when the packages first shipped, the advisories became authoritative on 2026-07-20 and lockfile-lookup coverage is now available - None of the 264 packages have surviving version tarballs on the public NuGet gallery - all appear as "listed: false" / unlisted. Private NuGet feeds (Artifactory, Azure Artifacts, MyGet, on-prem servers) that cached the tarballs during the publish window WILL keep serving them after the public unlist ## What to do 1. Grep every `.csproj`, `packages.config`, `packages.lock.json`, and `paket.lock` for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build host and downstream .NET runtime could reach, and re-image the affected workstation 2. **If you had any `Solana`, `SolanaWallet`, `solnet*`, `nethereumunified`, `Notus.Wallet.Utility.Net`, `LedgerWallet.Net`, `bitcoincore`, `BitcoinLib.Net`, `Litecoin` package**: treat all crypto wallets, private keys, mnemonic seeds, and Ledger device tokens accessible from the affected .NET dev host or CI runner as compromised - this cluster is specifically targeted at .NET developers integrating cryptocurrency wallet functionality. Move funds to a new wallet from a clean device 3. **If you had any `WPF-UI-Net`, `Bunifu.*`, `LiveCharts.*`, `Wpf*`, `WinForms`, `MetroModern.UI2`, `Sanka.UI*`, `Shade.*`, `ReaLTaiizor-WinForm`, `Ultimate.Wpf.Toolkit`, or similar UI toolkit package**: these are typosquats of legitimate WPF/WinForms UI libraries (e.g. `WPF-UI`, `Bunifu.UI.WinForms`, `LiveCharts`, `WpfAnimatedGif`). Check the real package name letter-by-letter - legitimate `WPF-UI` is at `Wpf-UI` (single hyphen, no `.Net` suffix), `Bunifu.UI.WinForms` is the trademarked publisher name (typosquat variants add `Net`/`Core`), `LiveCharts` is a specific publisher's package (typosquats add `.net`/`.Wpf.net`/`.WinForms.net`) 4. **If you had any `OCI.DotNetSDK.*` package**: verify the exact publisher and namespace against [Oracle's official OCI SDK for .NET](https://github.com/oracle/oci-dotnet-sdk) - the legitimate Oracle-published packages live under a specific publisher account, and the 25-package typosquat cluster above adds extra service suffixes or capitalization variants that Oracle does not ship 5. **If you had any `Binance.*`, `Kucoin.*`, `Kraken*`, `Bybit.*`, `Coinbase.*`, `Huobi.*`, `Ripple.*`, `stripeapi.net`, `PayPalMerchant.SDK`, `Reddit.api`, `Whatsapp.API`, `YoutubeExtractor.Net`, `TheOpenAI.API`, `Zendesk*` package**: these are typosquats of legitimate exchange/payment/API SDKs. The legitimate packages use different publisher accounts; verify against each API vendor's official NuGet publisher page 6. Verify none of the 264 listed packages still resolves via your private NuGet feed - internal Artifactory / Azure Artifacts / MyGet instances routinely cache tarballs and will keep serving the original versions after the public unlist 7. For .NET projects with the `true` setting or that use `packages.lock.json`, rebuild the lock file from a clean nuget.config that pins the official `api.nuget.org` feed with signature verification enabled - some of the typosquats above ship without the standard Microsoft/organization signing certificates that the legitimate SDKs carry ## References - [GitHub Advisory Database - recent NuGet malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anuget&sort=published-desc) - GitHub - [GHSA-4gf2-ff97-7c3f - Zendesk NuGet malware advisory (representative of the 6-package Zendesk cluster)](https://github.com/advisories/GHSA-4gf2-ff97-7c3f) - GitHub - [GHSA-566p-fvh4-6769 - Solana NuGet malware advisory (representative of the Solana wallet cluster)](https://github.com/advisories/GHSA-566p-fvh4-6769) - GitHub - [GHSA-cx6p-qpgp-xpf7 - WPF-UI-Net malware advisory (representative of the WPF/WinForms typosquat cluster)](https://github.com/advisories/GHSA-cx6p-qpgp-xpf7) - GitHub - [GHSA-hcxj-v95v-89pw - OCI.DotNetSDK.Net malware advisory (representative of the OCI SDK typosquat cluster)](https://github.com/advisories/GHSA-hcxj-v95v-89pw) - GitHub - [GHSA-vc2w-9pj4-6qch - Zendesk-Api NuGet malware advisory](https://github.com/advisories/GHSA-vc2w-9pj4-6qch) - GitHub --- Canonical page: https://dependencywatch.io/incident/nuget-2026-07-20-ghsa-backfill-sweep Markdown version: https://dependencywatch.io/incident/nuget-2026-07-20-ghsa-backfill-sweep.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).