Which versions of Pathoschild.Stardew.Mod.BuildConfig are malicious?

The following NuGet versions of Pathoschild.Stardew.Mod.BuildConfig are flagged malicious: 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.3.1, 6.5.1. Treat any of these as compromised.

How do I remediate Pathoschild.Stardew.Mod.BuildConfig if I installed it?

Remove Pathoschild.Stardew.Mod.BuildConfig from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed Pathoschild.Stardew.Mod.BuildConfig — how do I know if it already compromised me?

If Pathoschild.Stardew.Mod.BuildConfig was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is Pathoschild.Stardew.Mod.BuildConfig part of a known attack campaign?

Yes — Pathoschild.Stardew.Mod.BuildConfig is associated with the RLMA-2024-03396, RLUA-2024-07711 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find Pathoschild.Stardew.Mod.BuildConfig across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for Pathoschild.Stardew.Mod.BuildConfig (11 malicious versions).

Malicious package

Pathoschild.Stardew.Mod.BuildConfigNuGet

Pathoschild.Stardew.Mod.BuildConfig is a confirmed malicious NuGet package (MAL-2024-4608) that executes malicious code on install (malicious versions 6.2.1, 6.2.2, 6.2.3…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in Pathoschild.Stardew.Mod.BuildConfig (NuGet)

MAL-2024-4608

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

remove Pathoschild.Stardew.Mod.BuildConfig

Malicious versions

11 flagged

6.2.16.2.26.2.36.2.46.2.56.2.66.2.76.2.86.2.96.3.16.5.1

Indicators of compromise (SHA-256)

a867f70da9054a6ec09a4bb6d7966d0be0f881ac01c50d6780569a8a5a684700

9d836eb2509cf3781b6fd601c4f9d5f74330a432d9f76c3b9ce9ca37d3266b17

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for Pathoschild.Stardew.Mod.BuildConfig (11 malicious versions).
If you installed it — respond
Remove Pathoschild.Stardew.Mod.BuildConfig from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If Pathoschild.Stardew.Mod.BuildConfig was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. Pathoschild.Stardew.Mod.BuildConfig on NuGet has been identified as a malicious package (versions 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, and 3 more flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-03396RLUA-2024-07711

References

reversinglabs.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks Pathoschild.Stardew.Mod.BuildConfig-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database