Security experts have helped remove malicious NuGet packages planted in 2023 that were designed to destroy systems years in advance, with some payloads not due to hit until the latter part of this decade.

Socket's researchers identified nine malicious packages on the .NET package manager containing destructive code due to trigger between 2027 and 2028, with one affecting "safety-critical systems in manufacturing environments."

Of the 12 packages published by the NuGet user shanhai666 between 2023 and 2024, nine contained malicious code and have been downloaded nearly 10,000 times.

Notably, the packages are comprised of genuinely useful code serving legitimate purposes. Kush Pandya, security engineer at Socket, said 99 percent of the code among these packages was benign, which serves as

See Full Page