GCVE-110-OSM-2025-423

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published December 23, 2025

Malicious NuGet package flagged in OSV.dev (advisory MAL-2025-192890). Listed in the OSSF/OSV malicious-packages dataset; reported by ReversingLabs. Package should not be installed.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	sqzrframework480	0.0.1, 0.0.12, 0.0.13, 0.0.14, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 1.0.0, 1.0.1, 24.1.24 (affected)	—

Aliases

MAL-2025-192890

References

Malicious nuget package: sqzrframework480

advisory

vendor

Browse GCVE Records

72,409 records in the GCVE database · Updated July 14, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON