NuGet Sabotage: Time-Delayed Logic in 9 Packages Risks Total App Destruction on Hardcoded Dates

A nine-pack NuGet sabotage campaign, published under the alias shanhai666 between 2023 and 2024, uses time-delayed destructive payloads aimed at database applications and industrial control systems, according to Socket’s Threat Research Team. The malicious packages blend legitimate code with hidden sabotage, with about 99% of the codebase appearing genuine and adopting common patterns such as Repository, Unit of Work, and ORM reflection mapping.

The attackers inject malicious logic via C# extension methods, adding two methods—.Exec() and .BeginTran()—across all packages, which trigger destructive actions after hardcoded dates, including August 8, 2027 and November 29, 2028.

After the trigger date, the malware performs a random check with a 20% probability to terminate the host process, potentially causing total service disruption for high-throughput systems, and Sharp7Extend also terminates processes with 20% probability on PLC connections until 6 June 2028 while later causing 80% silent write failures.

NuGet was notified and is investigating, though the packages remained live at publication, and three legitimate packages were released alongside the nine malicious ones to bolster credibility.