This phishing campaign was discovered by analysts at Checkmarx and Illustria, who worked together to uncover and map the infection impacting the open-source software ecosystem.Almost all of these sites request visitors to enter their email, username, and account passwords, which is where the phishing step takes place.The fake sites feature an element that resembles the promised free generator but fails when visitors try to use it, asking for “human verification.”This initiates a series of redirections to survey sites, finally landing on legitimate e-commerce websites using affiliate links, which is how the threat actors generate revenue from the campaign.The security researchers who discovered this campaign informed NuGet of the infection, and all packages have since been delisted.However, considering the automated method employed by the threat actors to upload such a large number of packages in such a short time, they could re-introduce the threat using new accounts and different package names at any time."