# minimutex (NuGet) malicious package — MAL-2025-192889 | O3 Security

Malicious package

# minimutexNuGet

Advisory published Dec 23, 2025·Updated Dec 24, 2025

minimutex is a confirmed malicious NuGet package (MAL-2025-192889) that executes malicious code on install (malicious versions 1.1.0, 1.2.0, 1.2.2…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in minimutex (NuGet)

MAL-2025-192889

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

remove minimutex

## Malicious versions

5 flagged

1.1.01.2.01.2.21.2.31.2.4

## Indicators of compromise (SHA-256)

c49492a7bae05e62fe141391dff3e8ac227e965f460ae50ee256dc2782899d5b

## Detection & response playbook

Malicious package

1.  ### Find it
    
    Search your lockfiles and build artifacts for minimutex (5 malicious versions).
    
2.  ### If you installed it — respond
    
    Remove minimutex from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
    
3.  ### Did it already run?
    
    If minimutex was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
    

## Frequently asked questions

No. minimutex on NuGet has been identified as a malicious package (versions 1.1.0, 1.2.0, 1.2.2, 1.2.3, 1.2.4 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

## Campaign

RLMA-2025-06545

## Credits

-   ReversingLabs · finder

## Detect & block this

O3 blocks minimutex\-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

[Malware detection](/malware-detection) [Runtime egress monitoring](/egress-monitor)

## Explore

[All malware advisories](/malware) [How O3 detects malware](/malware-database) [Vulnerability database](/vulnerability)