Malicious NuGet Packages Hide Time

Researchers found nine NuGet packages hiding time-delayed code that can crash apps or corrupt industrial systems.

Researchers at Socket have identified a sophisticated supply-chain attack campaign in which nine malicious NuGet packages embed time-delayed, probabilistic sabotage routines into otherwise legitimate .NET libraries.

The packages , downloaded 9,488 times before disclosure, use hidden triggers to kill host processes and, in one case, corrupt industrial control system write operations.

The malicious packages were published under the alias shanhai666 between 2023 and 2024.

Each malicious package delivers genuine, working functionality to establish trust and evade cursory review, while burying ~20 lines of malicious code.

The actor weaponizes C# extension methods (e.g., .Exec() for database commands and .BeginTran() for S7 PLC clients) so that every database query or PLC operation implicitly executes the injected logic.

After hardcoded (or encrypted) trigger dates, the payload computes a random number and calls Process.GetCurrentProcess().Kill() , abruptly terminating the application.

Trigger dates are staggered — some packages activate in 2027 or 2028 — extending the actor’s window to harvest victims before detection.

Sharp7Extend, the campaign’s most dangerous package, combines two sabotage modes.

The latter behavior corrupts PLC writes without obvious error messages, risking actuator non-response, failed safety engagements, and undetected production drift — effects that mimic intermittent hardware problems rather than a deliberate attack.

Several factors make these packages difficult to detect:

The attacker intentionally varied author metadata and forged signature artifacts to frustrate automated heuristics.

Defending against the NuGet campaign requires immediate action and long-term supply chain resilience.

This campaign demonstrates how supply-chain attacks can weaponize trusted code and time delays to achieve destructive effects while evading detection.

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University and brings years of hands-on experience to the field.

The ClickFix malware now uses videos, timers, and OS-specific tricks to deceive users into infecting their own devices.

Cybercriminals are exploiting hotel booking platforms in a global phishing scheme that tricks guests into paying for reservations twice.

Cisco warns that hackers are actively exploiting a 0-day flaw in its firewall software, putting unpatched systems at risk of full compromise.

The CBO breach exposes how the government shutdown is weakening federal cybersecurity defenses when they’re needed most.