Socket researchers uncover NuGet packages that silently sabotage industrial PLCs, safety ...

New research from Socket’s Threat Research Team identified nine malicious NuGet packages that deploy time-delayed payloads to crash applications and compromise ICS (industrial control systems). Published by a threat actor, the packages have been downloaded 9,488 times. They were reported to NuGet on November 5, 2025; NuGet confirmed an investigation and removal efforts, but the packages remain live on the registry at the time of publication.

“Published under the NuGet alias shanhai666 between 2023 and 2024, these packages terminate the host application process with 20% probability on each database query after specific trigger dates in 2027 and 2028,” Kush Pandya, a security engineer and researcher at Socket, detailed in a recent blog post. “The most dangerous package, Sharp7Extend, targets industrial PLCs with dual sabotage mechanisms: immediate random process termination and silent write failures that begin 30-90 minutes after installation, affecting safety-critical systems in manufacturing environments.”

Pandya added, “We’ve reported these packages to NuGet on November 5, 2025. NuGet confirmed they are investigating and working on removal, but the packages remain live on the registry as of publication.”

Pointing to indicators of Chinese origin, Pandya mentioned that multiple artifacts suggest the threat actor may be of Chinese origin. The alias shanhai666 itself appears to be Chinese ‘shanhai’ means ‘mountains and seas’ or could reference the mythological text Shan Hai Jing, while ‘666’ is Chinese internet slang for ‘excellent/smooth.’ Code analysis reveals Chinese-language throughout several malicious DLLs, including error messages that mean exception occurred, data request address incorrect, and connection failed. Additionally, some package metadata contains Chinese characters in descriptions and author fields.

Despite their malicious payloads, all nine packages are fully functional, with 99% of their code working as intended. They provide legitimate features such as a repository pattern with generic CRUD operations and a unit of work pattern supporting transaction management. The packages also include LINQ support with expression tree visitors, pagination through QueryPage() methods, and asynchronous operations across all database calls. Additionally, they offer entity mapping via reflection-based ORM features, a logging infrastructure using AOP interceptors, and batch operations for efficient inserts.

The post identified that this legitimate functionality serves multiple purposes: it builds trust as packages work as advertised, passes code reviews where reviewers see familiar patterns and real implementations, provides actual value encouraging adoption, masks the ~20-line malicious payload buried in thousands of lines of legitimate code, and delays discovery since even after activation, crashes appear as random bugs rather than systematic attacks.

Pandya identified that the hacker published 12 packages total, nine contain malicious code, while the remaining three are legitimate implementations to establish credibility. Developers researching the author find genuine, working packages alongside the malicious ones, reducing suspicion. The malicious packages strategically target all three major database providers used in [dot]NET applications, such as SQL Server, PostgreSQL, and SQLite, apart from ICS through the Sharp7Extend package.

The Sharp7Extend Typosquat package targets users of the legitimate Sharp7 library, a [dot]NET implementation for communicating with Siemens S7 PLCs (Programmable Logic Controllers). By appending ‘Extend’ to the trusted Sharp7 name, the hacker exploits developers searching for Sharp7 extensions or enhancements. This typosquatting technique increases the likelihood of accidental installation in industrial automation and manufacturing environments where Sharp7 is commonly deployed.

Sharp7Extend provides fully working Sharp7 PLC communication functionality by bundling the complete, unmodified Sharp7 library, version 1.1.79 by Federico Barresi, alongside the malicious code, making it extremely difficult to detect as malicious during testing or code review. Developers testing Sharp7Extend find it works exactly as expected for PLC operations, creating a false sense of security while the malicious extensions operate silently in the background.

Pandya detailed that the malware exploits C# extension methods to transparently inject malicious logic into every database and PLC operation. Extension methods allow developers to add new methods to existing types without modifying the original code – a C# feature that the hacker weaponizes for interception.

Each time an application executes a database query or PLC operation, these extension methods automatically execute, checking the current date against trigger dates (hardcoded in most packages, encrypted configuration in Sharp7Extend). After the trigger date passes, the malware generates a random number between 1 and 100. If the number exceeds 80, a 20% probability, the malware immediately terminates the entire application without warning or error logging.

At startup, S7ServeCollectionDeploy.st sets a random delay of 30 to 90 minutes during which the package appears fully functional. After this period, critical PLC write operations fail silently approximately 80 percent of the time, returning false success signals while leaving actuators, setpoints, and safety systems unchanged. By intercepting commands such as WriteDBSingleByte, WriteDBSingleInt, and WriteDBSingleDInt, the package creates hidden data integrity issues in ICS, undermining operations without triggering obvious alerts.

The combination of immediate random process termination and delayed write corruption creates a sophisticated, multi-layered attack that evolves. During the first 30 to 90 minutes, only the process termination mechanism is active, creating a roughly 20 percent chance of random crashes per PLC operation. These failures can easily be mistaken for network connectivity issues or hardware faults.

After the initial grace period, both mechanisms operate simultaneously, causing systems to experience random crashes while silently corrupting data in approximately 80 percent of operations. This combination makes root cause analysis extremely difficult, as the symptoms resemble intermittent hardware failures rather than deliberate malicious activity. This time-delayed activation ensures the package passes initial deployment testing while beginning data corruption within the first few hours of production use.

Pandya noted that while all packages were published under the NuGet alias shanhai666, the package metadata displays different author names across the malicious packages. “This deliberate inconsistency appears designed to evade detection systems that flag packages from the same author publishing multiple suspicious packages, and to create the false impression that packages originate from different developers.”

In conclusion, the post recognized that the campaign demonstrates sophisticated techniques rarely combined in NuGet supply chain attacks, such as staggered time-delay activation (2027-2028), inverted immediate activation, probabilistic execution evading detection, dual sabotage mechanisms (process termination and silent write failures), extensive legitimate functionality (99% working code) as cover, bundling of complete legitimate libraries, extension method hijacking for transparent interception, forged Microsoft code-signing certificates, typosquatting against industrial control libraries, and time-delayed fallback mechanisms that activate within hours of installation.

“The time gap between installation and activation, up to three years for database packages, 30-90 minutes for Sharp7Extend’s write sabotage, immediate for Sharp7Extend’s process termination makes attribution nearly impossible,” according to Pandya. “Developers who installed packages in 2024 will have moved to other projects or companies by 2027-2028 when the database malware triggers, and the 20% probabilistic execution disguises systematic attacks as random crashes or hardware failures.”

He added that this makes incident response and forensic investigation nearly impossible; organizations cannot trace the malware back to its introduction point, identify who installed the compromised dependency, or establish a clear timeline of compromise, effectively erasing the attack’s paper trail.

Furthermore, organizations must audit dependencies for the nine malicious packages and assume any system with these packages is fully compromised. ICS systems running Sharp7Extend may already be experiencing intermittent failures masquerading as PLC communication issues.

Across industrial environments, it is critical to audit all PLC write operations for data integrity issues and review safety system logs for missed commands or failed activations. Organizations should establish baseline monitoring for PLC communication success rates and implement write verification mechanisms to detect the roughly 80 percent silent write failure rate.

Defensive measures include tightening dependency hygiene and verifying publisher identities beyond NuGet aliases, scanning dependency changes both pre-merge and at install time, and monitoring for time-based logic or probabilistic execution patterns in dependencies. It is also important to alert on typosquats of industrial control libraries and to anticipate reattempts that may involve rotated package names, deeper obfuscation of trigger logic, or alternative activation mechanisms.