Socket Uncovers Malicious NuGet Packages with Delayed Activation
Supply-chain security firm Socket has identified 12 suspicious NuGet packages, nine of which contain malicious code set to activate in August 2027 and November 2028. These packages have been downloaded nearly 9,500 times, posing a latent threat to .NET applications using Microsoft SQL Server, PostgreSQL, or SQLite databases.
Kush Pandya of Socket discovered the campaign, noting the attacker's use of legitimate libraries to camouflage malicious payloads. "The 20-line malicious code hides within thousands of lines of valid code," Pandya explained. "Even after activation, failures mimic random bugs rather than revealing systematic attacks."
One package, Sharp7Extend, specifically targets industrial programmable logic controllers, indicating potential risks to critical infrastructure. The findings highlight evolving supply-chain threats that exploit trust in open-source ecosystems.
