Vulnerabilities · 108 days ago
A trusted-looking SDK can be the exfiltration point, not just the delivery mechanism. Here, the helper library itself reads the PFX file and sends the client ID, password, and certificate contents out through hidden telemetry, so the usual trust check of “inspect the repo” does not protect you.
Versions 2.0.0 through 2.0.4 of Sicoob.Sdk were found doing this and were later blocked by NuGet. The package was presented as an official .NET 8 SDK for Sicoob API integrations, and the stolen PFX material can support impersonation of the banking integration, not just package removal cleanup.
Teams using third-party SDKs for certificate-managed integrations should treat exposed credentials and archives as compromised. If the SDK handled mTLS material, the damage can persist after the package is removed because the secret material may already be out.
2 sources covering this story
Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets
Malicious Sicoob.Sdk stole PFX certificates and client IDs via NuGet downloads, enabling API impersonation and payment abuse risks.
Malicious NuGet Package Impersonates Sicoob SDK to Exfiltrat...
A malicious NuGet package impersonating Sicoob exfiltrated client IDs, PFX passwords, and banking certificates through Sentry telemetry.
Part of the PlainSec briefing for 2026-05-30