Loading story…
Security researchers have uncovered nine malicious NuGet packages published under the alias "shanhai666" between 2023 and 2024, which contain time-delayed logic bombs designed to sabotage database operations and industrial control systems. These packages, downloaded nearly 9,500 times, appear to function as legitimate software components, implementing common patterns such as repository and unit of work, but secretly embed destructive payloads set to activate on specific dates in 2027 and 2028. The most dangerous package, Sharp7Extend, specifically targets Siemens S7 programmable logic controllers (PLCs), with mechanisms for both immediate random process termination and delayed silent write failures that can compromise safety-critical manufacturing environments.
The malicious code is carefully concealed within otherwise functional packages, making detection difficult and allowing the threat actor to build trust among developers. The payloads are triggered either probabilistically on each database query or after a set period post-installation, causing application crashes or data corruption that may be mistaken for random bugs. All identified packages have been reported to NuGet, and while some have been removed, others remained available at the time of reporting. The incident highlights the growing risk of sophisticated supply chain attacks leveraging widely used open-source repositories to target both IT and operational technology environments.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Following Socket's findings, NuGet worked with the researchers to take down the nine malicious packages from the repository and organizations were urged to audit dependencies and assume compromise if the packages were present.
Analysis showed the most dangerous package, Sharp7Extend, specifically targeted Siemens S7 PLCs by causing random process termination and delayed write failures, creating potential safety risks in manufacturing environments.
Socket's Threat Research Team discovered that the packages contained hidden, time-delayed and probabilistic logic bombs designed to sabotage database operations and industrial control system workflows, with some triggers set years in the future.
Before they were removed, the nine packages were downloaded about 9,488 times, increasing the potential impact across database-backed applications and industrial environments.
Between 2023 and 2024, a threat actor using the alias 'shanhai666' published nine malicious NuGet packages that masqueraded as legitimate .NET libraries using typosquatting, forged metadata, and large amounts of benign code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
7 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcetheregister.com
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026
A wave of software supply-chain attacks spanning late 2025 through September 2026 compromised package-publishing and CI/CD credentials to push malicious updates into trusted ecosystems. Campaigns tracked as **S1ngularity**, **Shai-Hulud**, and **TeamPCP** stole secrets, infected downstream users, and in some cases republished themselves through additional packages. S1ngularity compromised Nx packages and abused victim-hosted AI agents and GitHub repositories to find and exfiltrate credentials, while Shai-Hulud expanded the approach with worm-like propagation using stolen npm credentials. TeamPCP was linked to similar compromises affecting Trivy, Checkmarx, LiteLLM, Telnyx, TanStack, and more than 60 npm packages; reporting attributes suspected losses of hundreds of millions of dollars to the group and notes the arrest of two people in Australia in connection with it. Microsoft published detection, investigation, and defensive guidance for **Shai-Hulud 2.0**, underscoring the need for organizations to investigate exposed publishing credentials, review package releases and CI/CD activity, rotate compromised secrets, and assess downstream environments for malicious dependency updates.
Sep 30, 2026
Security researchers reported multiple **software supply chain** threats targeting developers via public package ecosystems. Tenable analyzed a malicious npm package, **`ambar-src`**, that reached roughly **50,000 downloads** in days before removal; it executed during installation via **malicious `preinstall` behavior**, used evasion techniques, and dropped OS-specific payloads for Windows, Linux, and macOS, with typosquatting assessed as the likely lure (mimicking *`ember-source`*). Separate reporting described a campaign using **malicious NuGet packages** (e.g., **NCryptYo**, **DOMOAuth2_**, **IRAOAuth2.0**, **SimpleWriter_**) that impersonated legitimate .NET libraries, executed code on assembly load, and established local proxying/backdoor behavior to facilitate credential theft and persistence in ASP.NET environments. Additional coverage warned of an npm “worm-like” propagation pattern impacting **CI pipelines and AI coding tools**, reinforcing that developer tooling and build systems are high-risk choke points where a single poisoned dependency can spread quickly across environments. While the broader set of articles also included unrelated breach, ransomware, and policy items, the developer-focused supply chain reporting consistently emphasized that **installation-time execution** and **typosquatting/impersonation** enable compromise even when developers never directly call the malicious code, and that traditional detection can lag (e.g., low initial antivirus detection rates for obfuscated .NET payloads).
Jun 29, 2026