Malicious Package Affecting tracer.fody.nlog package, versions [0,]
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DOTNET-TRACERFODYNLOG-14424334
- published16 Dec 2025
- disclosed16 Dec 2025
- creditKirill Boychenko
Introduced: 16 Dec 2025
Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the Tracer.Fody.NLog package.
Overview
Tracer.Fody.NLog is a malicious package.
This package contains malicious code, and masquerades as a legitimate Tracer.Fody NLog adapter by typosquatting the real Tracer.Fody package and its maintainer. Instead of providing tracing functionality, it embeds hidden malware that scans for Stratis cryptocurrency wallet files, extracts wallet data and passwords via reflection hooks, and silently exfiltrates them to attacker-controlled infrastructure in Russia, using homoglyph-based identifiers and suppressed errors to evade detection.