malware nuget

SipNet.OpenAI.Realtime

discovered 2026-07-09

Sibling package in the same publisher's SIPSorcery typosquat family; its own code is a benign OpenAI Realtime client and does not reference DependencyInjector.Core directly. Declares a dependency on SipNet >=10.0.5, but NuGet's default lowest-applicable resolution picks the clean [email protected], so it does NOT pull the harvester by default. LATENT/CONDITIONAL vector only: it becomes a live delivery path if SipNet floats to >=12.8.4 via another constraint or an explicit pin. Recorded for family completeness; not malicious as installed by default.

Threat types

typosquat

Malicious versions

  • 12.8.3

Techniques

Read the full analysis →