nuget / udommeng.mistools_standard / 0.1.88

udommeng.mistools_standard 0.1.88

Riskhigh Vulnscritical

processes: 329
operations: 7.3K
packages: 22
compiler runs: 1
connections: 4
build time: 14s
job time: 14s
capture: 97 KB
records: 13K
bytes / record: 7.6

run acac6596-081a-47c5-a0cf-19a916de51f3 · built 2026-11-06 · complete View on NuGet Release

Graph

egress · high

Checks

13 of 15 clear Network activity Known vulnerabilities

Build behavior▲✓✓✓✓✓✓✓✓✓

Supply chain▲✓✓✓

Pipeline✓

Detections

Connected to a messaging service's API: api.telegram.org:443

api.telegram.org:443 › api.telegram.org:443

high

Network

4 peers

api.telegram.org:443 udommeng.mistools_standard's own build code · Consumer (consumer) · Telegram Messenger Inc undeclared
api.misschool.net:443 udommeng.mistools_standard's own build code · Consumer (consumer) · 453 Ladplacout Jorakhaebua unjudged
api.nuget.org:443 the package manager · dotnet (consumer) · Microsoft Corporation · 438 files · went into an output ecosystem
crl4.digicert.com:80 the package manager · dotnet (consumer) via NuGet signature verification profile (dotnet → *.digicert.com) · Akamai International B.V. infrastructure

Vulnerabilities2		Fix	Severity
Dependencies
System.Drawing.Common 4.7.0		>=4.7.2
CVE-2021-24112	.NET Core Remote Code Execution Vulnerability		critical
RestSharp 110.2.0		>=112.0.0
CVE-2024-45302	CRLF Injection in RestSharp's `RestRequest.AddHeader` method		medium

Dependencies21	Build behaviour
Google.Protobuf3.25.1
ini-parser-netstandard2.5.2
K4os.Compression.LZ41.2.6
K4os.Compression.LZ4.Streams1.2.6
K4os.Hash.xxHash1.0.6
Microsoft.NETCore.Platforms3.1.0
Microsoft.Win32.SystemEvents4.7.0
MySql.Data8.0.31
Newtonsoft.Json13.0.3
Portable.BouncyCastle1.9.0
RestSharp110.2.0
runtime.native.System.Data.SqlClient.sni4.4.0
runtime.win-arm64.runtime.native.System.Data.SqlClient.sni4.4.0
runtime.win-x64.runtime.native.System.Data.SqlClient.sni4.4.0
runtime.win-x86.runtime.native.System.Data.SqlClient.sni4.4.0
System.Configuration.ConfigurationManager4.4.1
System.Data.SqlClient4.9.0
System.Drawing.Common4.7.0
System.Security.Cryptography.ProtectedData4.4.0
System.Security.Permissions4.7.0
System.Windows.Extensions4.7.0

Versions89

1 of 1 jobs captured: restore-build-run success · Generated 2026-11-06 · run acac6596-081a-47c5-a0cf-19a916de51f3

analysis 0.1.0 · 2026-11-06 · 4346b99 · graph v2

Ships two hardcoded Telegram bot tokens in its DLL

Conclusion: secrets-leak
Covers: 0.1.88
Reviewed by: Bitbison
Updated: 2026-11-06

A MisSchool notification SDK whose compiled library embeds two usable Telegram Bot API tokens.

Udommeng.MisTools_Standard is a .NET Standard 2.0 library for the Thai school-management platform MisSchool. It ships database helpers (SQL Server and MySQL), INI settings read/write, date/time utilities, and notification clients that post to Line Notify, the Line Messaging API, Telegram, and MisSchool's own notification endpoint at api.misschool.net. Version 0.1.88 embeds two hardcoded Telegram bot tokens in the compiled DLL, so anyone who downloads the package can read and use the publisher's Telegram bots. The package was first published September 28, 2019 (89 versions total) and is still served on NuGet as of November 6, 2026.

What Udommeng.MisTools_Standard does

It is a client SDK for the MisSchool platform: an application that references it can send student check-in notifications. The SendNoti class posts check-in data (school number, student number, device id, message, time, photo) to https://api.misschool.net/api/notification, the school platform's own endpoint. MisUtil posts to https://notify-api.line.me/api/notify for Line Notify and to https://api.telegram.org/bot<token>/sendMessage and /sendPhoto for Telegram, and TelegramServiceLib queues Telegram sends with retry and rate-limit backoff. The connections to Telegram and to api.misschool.net are this library's purpose, not a hidden channel.

What the code does

lib/netstandard2.0/MisTools_Standard.dll — MisTools_Standard.MisUtil.SendTeleMessage(string message, string chatId, bool isEzschool) embeds two hardcoded Telegram Bot API tokens (format <bot id>:<secret>); its compiled body selects one when isEzschool is true and the other otherwise, then posts to https://api.telegram.org/bot<token>/sendMessage.
lib/netstandard2.0/MisTools_Standard.dll — MisTools_Standard.MisUtil.SendTelePhotoAsync(string photoUrl, string chatId, bool isEzschool) embeds the same two tokens and posts to https://api.telegram.org/bot<token>/sendPhoto.
Other overloads (SendTeleMessage(string message, string botToken, string chatId), SendTextTelegram(string message, string chatId, string botToken)) take the bot token from the caller, and GetTeleTokens reads tokens from a MySQL table; only the two overloads above hardcode the credentials.
The Line and school endpoints receive their tokens or data from the caller or configuration, not from embedded values.

Timeline (UTC)

When	What
September 28, 2019	First version 0.1.0 published
January 9, 2026	Version 0.1.88 published
November 6, 2026	Still served on NuGet; the embedded tokens remain in the DLL

If you installed it

The two Telegram bot tokens belong to the publisher's bots and are exposed to anyone who installs the package; they are not the installer's credentials and cannot be disabled by a consumer setting. If you use this library's Telegram helpers, pass your own bot token via the overloads that take one, and treat the embedded tokens as compromised — the publisher should revoke both bots and move the tokens out of the shipped assembly.

Indicators

hosts: api.telegram.org
files: lib/netstandard2.0/MisTools_Standard.dll
processes

What was examined

0.1.88: sha256:ed36ca0785e972f41391896fa710122b59042ec64d9076c9552d66d49f7ff5bd