Dubious NuGet Package May Portend Chinese Industrial Espionage

Researchers flagged a NuGet package named SqzrFramework480 that contains an Init method which decodes a concealed IP address, pings it, opens a socket, captures screenshots, and sends the data—behaviors consistent with potential industrial-espionage malware; the package is live on NuGet with ~3,000 downloads and exhibits obfuscation and suspicious account history, though active exploitation has not been confirmed.