NuGet Supply-Chain Exploit Uses Timed Destructive Payloads Against ICS

A sophisticated supply-chain attack has compromised critical industrial control systems through nine malicious NuGet packages designed to inject time-delayed destructive payloads into database operations and manufacturing environments. Socket’s Threat Research Team identified these weapons of code, published under the alias shanhai666 between 2023 and 2024, which have collectively accumulated 9,488 downloads before being reported to NuGet on 5 November 2025, according to NuGet.

The campaign combines 99% legitimate functionality as cover code with hidden payloads that trigger process termination with a 20% probability on each database query after specific dates in 2027 and 2028. The most dangerous package, Sharp7Extend, targets Siemens industrial PLCs through typosquatting, and bundles the unmodified Sharp7 library (version 1.1.79), enabling dual sabotage mechanisms that activate immediately upon installation and then, from 6 June 2028, silently corrupt write operations 80% of the time.

In manufacturing, healthcare, ecommerce, and financial platforms, the attack can cause cascading failures and significant operational disruption, with NuGet confirming investigation and removal efforts but noting that the malicious packages remain live at publication.