nuget / PrimeNgScraperBase.core / 1.0.40

PrimeNgScraperBase.core 1.0.40

Riskhigh Vulnshigh

processes: 329
operations: 16K
packages: 110
compiler runs: 1
connections: 4
build time: 15s
job time: 15s
capture: 209 KB
records: 28K
bytes / record: 7.5

run c7eecd7e-c319-438f-9502-db871171cbe3 · built 2026-11-05 · complete View on NuGet Release

Graph

egress · high

Checks

13 of 16 clear Network activity Known vulnerabilities +1 more

Build behavior▲✓✓✓✓✓✓✓✓✓

Supply chain▲▲✓✓✓

Pipeline✓

Detections

Connected to a messaging service's API: api.telegram.org:443

api.telegram.org:443 › api.telegram.org:443

high

Network

4 peers

api.telegram.org:443 PrimeNgScraperBase.core's own build code · Consumer (consumer) · Telegram Messenger Inc undeclared
api.nuget.org:443 the package manager · dotnet (consumer) · Microsoft Corporation · 2,515 files · went into an output ecosystem
crl.globalsign.com:80 the package manager · dotnet (consumer) via NuGet signature verification profile (dotnet → *.globalsign.com) · Cloudflare, Inc. infrastructure
crl4.digicert.com:80 the package manager · dotnet (consumer) via NuGet signature verification profile (dotnet → *.digicert.com) · Akamai International B.V. infrastructure

Vulnerabilities15		Fix	Severity
Dependencies
AutoMapper 13.0.1		>=15.1.1
CVE-2026-32933	AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion		high
SQLitePCLRaw.lib.e_sqlite3 2.1.10		none published
CVE-2025-6965	SQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite		high
System.Security.Cryptography.Pkcs 9.0.3 build		>=9.0.21
CVE-2026-84008	Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability		high
CVE-2026-70162	Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability		medium
System.Security.Cryptography.Xml 9.0.3 build		>=9.0.21
CVE-2026-26171	Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability		high
CVE-2026-32203	Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability		high
CVE-2026-33116	Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability		high
CVE-2026-47302	Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability		high
CVE-2026-47304	Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability		high
CVE-2026-50525	Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability		high
CVE-2026-50527	Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability		high
CVE-2026-50648	Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability		high
CVE-2026-96958	Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability		high
CVE-2026-96959	Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability		high
CVE-2026-96960	Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability		high

Dependencies109	Build behaviour
AutoMapper13.0.1
EPPlus8.0.8
EPPlus.Interfaces8.0.0
ExcelHelperEx1.1.6
Google.Apis1.71.0
Google.Apis.Auth1.71.0
Google.Apis.Core1.71.0
Google.Apis.Sheets.v41.70.0.3819
HtmlAgilityPack1.12.2
Microsoft.AspNetCore.Antiforgery2.3.0
Microsoft.AspNetCore.Authentication.Abstractions2.3.0
Microsoft.AspNetCore.Authentication.Core2.3.0
Microsoft.AspNetCore.Authentication.JwtBearer9.0.8
Microsoft.AspNetCore.Authorization2.3.0
Microsoft.AspNetCore.Authorization.Policy2.3.0
Microsoft.AspNetCore.Cors2.3.0
Microsoft.AspNetCore.Cryptography.Internal2.3.0
Microsoft.AspNetCore.DataProtection2.3.0
Microsoft.AspNetCore.DataProtection.Abstractions2.3.0
Microsoft.AspNetCore.Diagnostics.Abstractions2.3.0
Microsoft.AspNetCore.Hosting.Abstractions2.3.0
Microsoft.AspNetCore.Hosting.Server.Abstractions2.3.0
Microsoft.AspNetCore.Html.Abstractions2.3.0
Microsoft.AspNetCore.Http2.3.0
Microsoft.AspNetCore.Http.Abstractions2.3.0
Microsoft.AspNetCore.Http.Extensions2.3.0
Microsoft.AspNetCore.Http.Features2.3.0
Microsoft.AspNetCore.JsonPatch2.3.0
Microsoft.AspNetCore.Localization2.3.0
Microsoft.AspNetCore.Mvc2.3.0
Microsoft.AspNetCore.Mvc.Abstractions2.3.0
Microsoft.AspNetCore.Mvc.ApiExplorer2.3.0
Microsoft.AspNetCore.Mvc.Core2.3.0
Microsoft.AspNetCore.Mvc.Cors2.3.0
Microsoft.AspNetCore.Mvc.DataAnnotations2.3.0
Microsoft.AspNetCore.Mvc.Formatters.Json2.3.0
Microsoft.AspNetCore.Mvc.Localization2.3.0
Microsoft.AspNetCore.Mvc.Razor2.3.0
Microsoft.AspNetCore.Mvc.Razor.Extensions2.3.0
Microsoft.AspNetCore.Mvc.RazorPages2.3.0
Microsoft.AspNetCore.Mvc.TagHelpers2.3.0
Microsoft.AspNetCore.Mvc.ViewFeatures2.3.0
Microsoft.AspNetCore.Razor2.3.0
Microsoft.AspNetCore.Razor.Design2.3.0
Microsoft.AspNetCore.Razor.Language2.3.0
Microsoft.AspNetCore.Razor.Runtime2.3.0
Microsoft.AspNetCore.ResponseCaching.Abstractions2.3.0
Microsoft.AspNetCore.Routing2.3.0
Microsoft.AspNetCore.Routing.Abstractions2.3.0
Microsoft.AspNetCore.WebUtilities2.3.0
Microsoft.CodeAnalysis.Analyzers1.1.0
Microsoft.CodeAnalysis.Common2.8.2
Microsoft.CodeAnalysis.CSharp2.8.2
Microsoft.CodeAnalysis.Razor2.3.0
Microsoft.Data.Sqlite.Core9.0.8
Microsoft.EntityFrameworkCore9.0.8
Microsoft.EntityFrameworkCore.Abstractions9.0.8
Microsoft.EntityFrameworkCore.Analyzers9.0.8
Microsoft.EntityFrameworkCore.Relational9.0.8
Microsoft.EntityFrameworkCore.Sqlite9.0.8
Microsoft.EntityFrameworkCore.Sqlite.Core9.0.8
Microsoft.Extensions.Caching.Abstractions9.0.8
Microsoft.Extensions.Caching.Memory9.0.8
Microsoft.Extensions.Configuration9.0.3
Microsoft.Extensions.Configuration.Abstractions9.0.8
Microsoft.Extensions.Configuration.FileExtensions9.0.3
Microsoft.Extensions.Configuration.Json9.0.3
Microsoft.Extensions.DependencyInjection9.0.8
Microsoft.Extensions.DependencyInjection.Abstractions9.0.8
Microsoft.Extensions.DependencyModel9.0.8
Microsoft.Extensions.Diagnostics.Abstractions8.0.1
Microsoft.Extensions.FileProviders.Abstractions9.0.3
Microsoft.Extensions.FileProviders.Composite8.0.0
Microsoft.Extensions.FileProviders.Physical9.0.3
Microsoft.Extensions.FileSystemGlobbing9.0.3
Microsoft.Extensions.Hosting.Abstractions8.0.1
Microsoft.Extensions.Localization8.0.11
Microsoft.Extensions.Localization.Abstractions8.0.11
Microsoft.Extensions.Logging9.0.8
Microsoft.Extensions.Logging.Abstractions9.0.8
Microsoft.Extensions.ObjectPool8.0.11
Microsoft.Extensions.Options9.0.8
Microsoft.Extensions.Primitives9.0.8
Microsoft.Extensions.WebEncoders8.0.11
Microsoft.IdentityModel.Abstractions8.0.1
Microsoft.IdentityModel.JsonWebTokens8.0.1
Microsoft.IdentityModel.Logging8.0.1
Microsoft.IdentityModel.Protocols8.0.1
Microsoft.IdentityModel.Protocols.OpenIdConnect8.0.1
Microsoft.IdentityModel.Tokens8.0.1
Microsoft.IO.RecyclableMemoryStream3.0.1
Microsoft.Net.Http.Headers2.3.0
Newtonsoft.Json13.0.3
Newtonsoft.Json.Bson1.0.2
NLog6.0.3
NLog.Database6.0.3
NLog.Extensions.Logging6.0.3
NLog.Web.AspNetCore6.0.3
ParallelHelperEx1.0.8
SQLitePCLRaw.bundle_e_sqlite32.1.10
SQLitePCLRaw.core2.1.10
SQLitePCLRaw.lib.e_sqlite32.1.10
SQLitePCLRaw.provider.e_sqlite32.1.10
System.CodeDom7.0.0
System.ComponentModel.Annotations5.0.0
System.IdentityModel.Tokens.Jwt8.0.1
System.Management7.0.2
System.Security.Cryptography.Pkcs9.0.3
System.Security.Cryptography.Xml9.0.3

Versions38

1 of 1 jobs captured: restore-build-run success · Generated 2026-11-05 · run c7eecd7e-c319-438f-9502-db871171cbe3

analysis 0.1.0 · 2026-11-04 · bfee307 · graph v2

PrimeNgScraperBase.core sends login passwords to the author's Telegram chat

Conclusion: malicious
Covers: 1.0.40 and 1.0.19
Reviewed by: Bitbison
Updated: 2026-11-07

A NuGet package whose login controller forwards submitted usernames and passwords, and other user activity, to a hard-coded Telegram chat.

PrimeNgScraperBase.core is a NuGet package whose description is "base scraper backend with user management". It is a single precompiled .NET assembly, lib/net9.0/PrimeNgScraperBase.core.dll, that provides ASP.NET controllers for password and Google login, tickets, tasks, subscriptions and usage. When an application uses those controllers, the library makes HTTPS POSTs to the Telegram Bot API with a hard-coded bot token and chat id, and puts user data in the message text. It is not a hidden install hook; the exfiltration is in the ordinary login and ticket endpoints.

What PrimeNgScraperBase.core does

An application that uses the package's controllers and receives a login attempt triggers a request to api.telegram.org. On a failed password login, the submitted username and password are included in the message. Successful logins, Google logins, new Google users, ticket creation, ticket messages and ticket status changes are also sent to the same chat.

What the code does

PrimeNgScraperBase.core.Services.TelegramService (decompiled from lib/net9.0/PrimeNgScraperBase.core.dll) holds a hard-coded Telegram bot token and a Send method that posts a form to https://api.telegram.org/bot<token>/sendMessage with a hard-coded chat id and the message text (lines 1918-1943 of the decompiled assembly).
UserController.Login sends "Login attempt failed for {credential.Username}, {credential.Password}" to that chat when a login fails, so the submitted password leaves for the author's Telegram chat (line 5270).
UserController.Login sends "{credential.Username} logged in" on success (line 5279); UserController.GoogleLogin sends "{username} logged in with Google" and "new Google user {username} created" (lines 5356, 5390).
TicketsController.Create, AddMessage and UpdateStatus send ticket titles, message text, usernames and status changes to the same chat (lines 4636, 4673, 4703).
The destination token and chat id are hard-coded; no setting disables these sends.

Timeline (UTC)

When	What
2025-08-13	1.0.1 published, without the Telegram code
2025-09-30	1.0.19 published, introducing the Telegram sends and the failed-login password forwarding
2026-05-23	1.0.40 published, still containing the same code
2026-11-07	still served on NuGet; the credential forwarding remains in the shipped assembly

If you installed it

Remove the package, and treat any credentials submitted to an application that used it from version 1.0.19 onward as compromised: usernames and passwords from failed login attempts are forwarded to a Telegram chat outside your control. The destination is hard-coded and cannot be turned off by configuration.

Indicators

hosts: api.telegram.org
files: lib/net9.0/PrimeNgScraperBase.core.dll
processes

What was examined

1.0.19: sha256:9b88b46cb889ed5103e73dbbc4c64b8858a0e89e748513f6a3a53fb612f5e203
1.0.40: sha256:e64e488236fdb681d52ad28d4bd545b4163ca2c79f4ae1d3eddc78c51d8c5866