nuget / jari.fntrust.shared

jari.fntrust.shared 2.7.19

Riskhigh Vulnshigh

processes: 329
operations: 13K
packages: 75
compiler runs: 1
connections: 6
build time: 33s
job time: 33s
capture: 176 KB
records: 24K
bytes / record: 7.3

Package Description

348,847 downloads View on NuGet Release

Graph

egress · high

Checks

13 of 15 clear Network activity Known vulnerabilities

Build behavior▲✓✓✓✓✓✓✓✓✓

Supply chain▲✓✓✓

Pipeline✓

Detections

Connected to a messaging service's API: api.telegram.org:443

api.telegram.org:443 › api.telegram.org:443

high

Network

6 peers

api.telegram.org:443 jari.fntrust.shared's own build code · Consumer (consumer) · Telegram Messenger Inc undeclared
globalcdn.nuget.org:443 jari.fntrust.shared's own build code · Consumer (consumer) · Akamai International B.V. unjudged
www.nuget.org:443 jari.fntrust.shared's own build code · Consumer (consumer) · Microsoft Corporation unjudged
api.nuget.org:443 the package manager · dotnet (consumer) · Microsoft Corporation · 1,739 files · went into an output ecosystem
crl4.digicert.com:80 the package manager · dotnet (consumer) via NuGet signature verification profile (dotnet → *.digicert.com) · Akamai International B.V. infrastructure
www.microsoft.com:80 the package manager · dotnet (consumer) via NuGet signature verification profile (dotnet → www.microsoft.com) · Akamai Technologies, Inc. infrastructure

Vulnerabilities6		Fix	Severity
Dependencies
SixLabors.ImageSharp 3.1.11		>=3.2.0
CVE-2026-106110	ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer		high
CVE-2026-106113	ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index		high
CVE-2026-106115	ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer		high
CVE-2026-106118	ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write		high
CVE-2026-106114	ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions		medium
CVE-2026-106116	ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop		medium

Dependencies74	Build behaviour
Aliyun.OSS.DotNetCore2.8.0
Amazon.Core0.3.2
Amazon.S34.0.0
AWSSDK.Core3.7.400.49
AWSSDK.S33.7.405.13
BitMiracle.LibTiff.NET2.4.649
Carbon.Json1.0.0
Carbon.Storage1.0.0
Google.Protobuf3.23.0
Grpc2.46.6
Grpc.Core2.46.6
Grpc.Core.Api2.62.0
Grpc.Net.Client2.62.0
Grpc.Net.Common2.62.0
IronPdf2025.10.8
IronPdf.Native.Chrome.Windows2025.10.11
IronPdf.Slim2025.10.8
IronSoftware.Abstractions2025.4.2
IronSoftware.Common2025.10.1
IronSoftware.Drawing.Abstractions2025.4.2
IronSoftware.Native.PdfModel2025.10.11
IronSoftware.System.Drawing2025.9.3
Microsoft.AspNetCore.Authentication.Abstractions2.2.0
Microsoft.AspNetCore.Authentication.Core2.2.0
Microsoft.AspNetCore.Authorization2.2.0
Microsoft.AspNetCore.Authorization.Policy2.2.0
Microsoft.AspNetCore.Hosting.Abstractions2.2.0
Microsoft.AspNetCore.Hosting.Server.Abstractions2.2.0
Microsoft.AspNetCore.Http2.2.2
Microsoft.AspNetCore.Http.Abstractions2.2.0
Microsoft.AspNetCore.Http.Extensions2.2.0
Microsoft.AspNetCore.Http.Features2.2.0
Microsoft.AspNetCore.Mvc.Abstractions2.2.0
Microsoft.AspNetCore.Mvc.Core2.2.5
Microsoft.AspNetCore.ResponseCaching.Abstractions2.2.0
Microsoft.AspNetCore.Routing2.2.0
Microsoft.AspNetCore.Routing.Abstractions2.2.0
Microsoft.AspNetCore.StaticFiles2.2.0
Microsoft.AspNetCore.WebUtilities2.2.0
Microsoft.DotNet.PlatformAbstractions2.1.0
Microsoft.Extensions.Configuration6.0.2
Microsoft.Extensions.Configuration.Abstractions8.0.0
Microsoft.Extensions.Configuration.Binder8.0.1
Microsoft.Extensions.Configuration.FileExtensions6.0.1
Microsoft.Extensions.Configuration.Json6.0.1
Microsoft.Extensions.DependencyInjection2.2.0
Microsoft.Extensions.DependencyInjection.Abstractions2.2.0
Microsoft.Extensions.DependencyModel2.1.0
Microsoft.Extensions.FileProviders.Abstractions6.0.1
Microsoft.Extensions.FileProviders.Physical6.0.1
Microsoft.Extensions.FileSystemGlobbing6.0.0
Microsoft.Extensions.Hosting.Abstractions2.2.0
Microsoft.Extensions.Logging.Abstractions6.0.4
Microsoft.Extensions.ObjectPool2.2.0
Microsoft.Extensions.Options2.2.0
Microsoft.Extensions.Primitives8.0.0
Microsoft.Extensions.WebEncoders2.2.0
Microsoft.Net.Http.Headers2.2.0
Microsoft.OpenApi1.6.14
Microsoft.Win32.SystemEvents6.0.0
Newtonsoft.Json13.0.1
Polly8.2.0
Polly.Core8.2.0
SixLabors.Fonts2.1.3
SixLabors.ImageSharp3.1.11
SixLabors.ImageSharp.Drawing2.1.7
Swashbuckle.AspNetCore.Swagger6.6.2
Swashbuckle.AspNetCore.SwaggerGen6.6.2
System.ComponentModel.Annotations4.5.0
System.Configuration.ConfigurationManager6.0.2
System.Drawing.Common6.0.0
System.Security.Cryptography.ProtectedData6.0.0
System.Security.Permissions6.0.1
System.Windows.Extensions6.0.0

Versions500

1 of 1 jobs captured: restore-build-run success · Generated 2026-11-06 · run 52e133f7-6f41-4e2e-8202-1cd6a19daee9

analysis 0.1.0 · 2026-11-06 · 4346b99 · graph v2

Jari.FnTrust.Shared ships a live Telegram bot token inside FnTrust.Shared.dll

Conclusion: secrets-leak
Covers: 2.7.19, 2.4.66 and 2.0.88
Reviewed by: Bitbison
Updated: 2026-11-07

The NuGet package Jari.FnTrust.Shared embeds a working Telegram bot token and a fixed chat ID in its DLL, which a public service class uses to post messages to a Telegram chat.

Jari.FnTrust.Shared is a .NET shared library published by the NuGet account "Jari" (no public source repository). It packages protobuf/gRPC contracts and helper services for a fund-trust platform: accounting, identity, KYC, payments, funds, wallets, notifications, SMS, email, PDF generation and file upload to S3/Aliyun OSS. Version 2.7.19 embeds a working Telegram bot token and a fixed destination chat ID inside its FnTrust.Shared.dll; a public service class uses them to post messages to that Telegram chat. The token is live, so the package ships a usable credential belonging to the publisher's own Telegram bot.

What Jari.FnTrust.Shared does

When code that references the package calls FnTrust.Shared.TelegramBot.AsbarTelegramBotService.SendToChannelAsync(message), the library opens an HTTPS connection to api.telegram.org and posts a JSON body {chat_id, text: message} to https://api.telegram.org/bot<token>/sendMessage, using a bot token and chat ID compiled into the DLL as static fields. The method is public but nothing else in the assembly calls it, so the package does not send anything to Telegram on its own; only code that explicitly invokes the method triggers the message. The bot reports its name as "Asbar Capital".

What the code does

lib/net8.0/FnTrust.Shared.dll, type FnTrust.Shared.TelegramBot.AsbarTelegramBotService: the static field _botToken holds the Telegram bot token and the static field _chatId holds the destination chat ID (values compiled into the assembly).
SendToChannelAsync(string message) composes the URL "https://api.telegram.org/bot" + _botToken + "/sendMessage" and POSTs the JSON {"chat_id": _chatId, "text": message}, then reads the response body.
No other type in the assembly references AsbarTelegramBotService, so there is no automatic invocation anywhere in the package.

Timeline (UTC)

When	What
2025-11-26 05:38	Version 2.0.88 published, the first version whose DLL contains AsbarTelegramBotService with the embedded token and chat ID.
2026-11-06 22:54	Version 2.7.19 published; it still ships the same token.
2026-11-07	Still listed on NuGet, nearly a year after the token first appeared.

If you installed it

Anyone who has the DLL can read the embedded bot token, so the Telegram bot should be treated as compromised and revoked/rotated via BotFather. The package does not read your environment or send data on its own; the only Telegram traffic is a message your own code passes to SendToChannelAsync, delivered to the hardcoded chat. If you do not use that service, do not call it. Be aware that any message you send through it goes to a chat controlled by the embedded token.

Indicators

hosts: api.telegram.org
files: lib/net8.0/FnTrust.Shared.dll
processes

What was examined

2.0.88: sha256:565193582d66bbe8a6de6adb307d5cc2d018a07f824bde225f0300077acfca4c
2.4.66: sha256:4052905d49eca70d4c2c3a28dd21a8f45bf6e17fce3356974c36240c37b75b18
2.7.19: sha256:8cbc07addf7bddd978d05cfffad6921f90fa3c2ca2a6b2561f6a06155e3eb6fd