Time-delayed malware spread by nefarious NuGet packages

Malware was set to be deployed between 2027 and 2028 by nine of the dozen NuGet packages uploaded by shanhai666 between 2023 and 2024, according to The Register.

All of the malicious packages, which have been removed after amassing nearly 10,000 downloads, had useful code to establish trust, while some were aimed at key database providers, such as PostgreSQL, SQL Server, and SQLite, a report from Socket showed.

Most severe of the illicit NuGet packages was the Siemens S7 programmable logic controller-targeting Sharp7Extend, which launches illicit code immediately after installation but not after June 6, 2028. Additional findings revealed that Sharp7Extend could facilitate either the complete termination of Siemens S7 PLCs or data corruption that renders critical commands useless 80% of the time.

"Organizations must audit dependencies for the nine malicious packages immediately and assume any system with these packages is fully compromised. Industrial control systems running Sharp7Extend may already be experiencing intermittent failures masquerading as PLC communication issues," Socket's Kush Pandya.