Malicious Package Affecting sanka.ui3.winforms package, versions [3.7.53][3.7.41][3.7.43][3.7.36][3.7.33][3.7.46][3.7.10][3.7.20][3.7.30][3.7.39][3.7.23][3.7.34][3.7.28][3.7.37][3.7.52][3.7.25][3.7.35][3.7.31][3.7.49][3.7.26][3.7.11][3.7.27][3.7.24][3.7.48][3.7.44][3.7.9.6][3.7.17][3.7.19][3.7.13][3.7.14][3.7.18][3.7.15][3.7.6][3.7.50][3.8.9.6][3.7.32][3.7.21][3.7.51][3.7.22][3.7.45][3.7.42][3.7.12][3.7.8][3.7.9][3.7.16][3.7.47][3.7.29][3.7.38][3.7.54][3.7.40][3.7.55][3.7.7]
Threat Intelligence
Exploit Maturity
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Attacked
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DOTNET-SANKAUI3WINFORMS-18138071
- published22 Jul 2026
- disclosed20 Jul 2026
- creditUnknown
Introduced: 20 Jul 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Avoid using all malicious instances of the Sanka.UI3.WinForms package.
Overview
Sanka.UI3.WinForms is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.