Poisoned Dependencies: How Nethereum.All and 10M+ Fake Downloads Looted .NET Crypto Developers

A recent ReversingLabs report details a sophisticated NuGet supply chain campaign targeting .NET developers in the crypto space, centred on a malicious package called Nethereum[.]All that impersonates the legitimate Ethereum integration library. The campaign has been active since July 2025, with researchers noting it uses inflated download counts and copied code to masquerade as trusted software.

The investigation began on 17 October when the Nethereum[.]All package was flagged, revealing that the malicious code mirrors legitimate tools while hiding functionality designed to steal funds and secrets. Screenshots show Nethereum[.]All displaying 10.4 million downloads, contributing to a false sense of trust, while the broader operation includes 14 malicious packages published by various author accounts.

Technical analysis found that some malware exfiltrates credentials, including Google Ads ClientId, ClientSecret and DeveloperToken, through a SendLog function to access API keys alongside crypto theft. The campaign also extends beyond Ethereum to other ecosystems, with a package named NBitcoin[.]Unified aimed at Bitcoin developers and SolnetAll for Solana developers, which was removed from NuGet before full analysis.