Hidden Logic Bombs in Malware-Laced NuGet Packages Set to Detonate Years After Installation

According to Socket, a set of nine malicious NuGet packages published in 2023 and 2024 by a user named “shanhai666” can drop time-delayed payloads designed to sabotage database operations and corrupt industrial control systems. The packages are programmed to run malicious code after trigger dates in August 2027 and November 2028, and they were collectively downloaded 9,488 times.

The most dangerous package, Sharp7Extend, targets industrial PLCs and can cause immediate random process termination and silent write failures that begin 30–90 minutes after installation, with termination activated again after installation and continuing until 6 June 2028. A separate set of trigger dates includes August 8, 2027 for certain SQL Server, PostgreSQL, and SQLite implementations (MCDbRepository) and November 29, 2028 for SqlUnicornCoreTest and SqlUnicornCore.

Socket noted that the threat actor published a total of 12 packages, with three additional ones removed from NuGet, and that the campaign uses extension methods to intercept queries and PLC operations, potentially obscuring attacks as random crashes or hardware failures.