Nine NuGet packages disrupt DBs and industrial systems with time-delayed payloads

Nine NuGet packages published between 2023 and 2024 by “shanhai666” can deploy time-delayed payloads to disrupt databases and industrial control systems, according to Socket. The packages, including Sharp7Extend, target SQL Server, PostgreSQL and SQLite, and are designed to sabotage both databases and PLCs with concealed malware that activates on future dates or immediately, with triggers set for August 2027 and November 2028.

The nine packages were downloaded 9,488 times, and one package, Sharp7Extend, can terminate processes with a 20% probability and later cause 30–90 minutes of delayed write failures, leading to silent data corruption and potential disruption of safety-critical systems. The report notes that Sharp7Extend also silently corrupts data after an initial grace period, with 80% of write operations failing, affecting actuators and production controls.

Malicious code uses aliasing and typosquatting to hide connections, and the attacker’s identity remains unknown, though the report claims the threat actor may be of Chinese origin. Socket’s researchers flagged that time-delayed activation and mixed sabotage techniques make attribution difficult and emphasise the need for vigilance when developers install NuGet packages.