Bleepingcomputer

Malicious NuGet Packages Set to Activate Time Bombs in 2027 and 2028

First seen 2 Dec 2025, 18:33 UTC • •8.3

Article Content

1 / 8

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Nine malicious NuGet packages, published by the user 'shanhai666', were identified to contain time-delayed sabotage payloads targeting industrial control systems and applications. These packages, which have been downloaded 9,488 times, are designed to activate between 2027 and 2028, using probabilistic triggers to execute their malicious routines. An investigation and removal efforts have been initiated by NuGet following their discovery.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 225d ago How this analysis works

More articles in this cluster (7)

Threat Graph

11 entities, 12 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
Supply Chain Attack

Malware (1)

Sharp7Extend

Affected Platform (8)

.NET
NuGet
PostgreSQL
Sharp7
Siemens S7
Siemens S7 PLCs
SQLite
SQL Server

Relationships

Malware targets .NET
Malware targets NuGet
Malware targets PostgreSQL
Malware targets Sharp7
Supply Chain Attack targets .NET
Supply Chain Attack targets NuGet
Supply Chain Attack targets PostgreSQL
Supply Chain Attack targets Sharp7
Sharp7Extend related to Siemens S7
Sharp7Extend related to Siemens S7 PLCs
Sharp7Extend related to SQLite
Sharp7Extend related to SQL Server

Following this threat?

Track Sharp7Extend in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Critical SQL Injection Zero-Day in Arista VeloCloud Orchestrator Exploited Arista Networks has patched a critical zero-day vulnerability (CVE-2026-114625) in its VeloCloud Orchestrator (VCO) that is actively being exploited. The flaw allows authenticated users, even those with basic privileges, to escalate their access to superuser status via a low-complexity SQL injection attack. This…