Microsoft Cuts NuGet API Key Lifetimes to Reduce Package Publishing Abuse
Supply Chain Risk · 3 sources · Updated 3mo ago · First seen Aug 4, 2026
Microsoft said NuGet.org will shorten the lifetime of newly created API keys from 365 days to 30 days to reduce software supply-chain risk from stolen publishing credentials. The change takes effect on August 17, 2026, and Microsoft warned that attackers who obtain long-lived keys can publish trojanized .NET packages under trusted project names, creating rapid downstream exposure for developers and enterprises.
The company also said all NuGet API keys created before that date will expire on November 1, 2026, requiring maintainers to generate new keys or migrate to NuGet Trusted Publishing. Microsoft is pushing the OIDC-based model, introduced in 2025, because it replaces reusable secrets with short-lived session credentials for workflows such as GitHub Actions and GitLab, and cited the NX Console npm package compromise as a recent example of how stolen publishing credentials can be used to poison software packages.
