Cybercrims plant destructive time bomb malware in industrial .NET extensions

November 7, 2025

Nine out of twelve NuGet packages were found to contain hidden destructive code meant to activate in the future targeting critical manufacturing systems. The malicious Sharp7Extend package exploits trust through legitimate functionalities posing immediate threats to industrial control systems while embedding delayed triggers in other packages to confuse detection efforts.

The exploitation of trust in software dependencies poses a serious challenge for cybersecurity within the software development lifecycle. The malicious packages identified by Socket use a sophisticated combination of genuine code and hidden threats allowing them to pass code reviews and be accepted into production environments without triggering alarms. The implications of such attacks reach far beyond mere data theft or system crashes; they threaten operational safety in critical industries. In the case of Sharp7Extend not only does it disrupt normal operations but the potential for causing safety-critical failures in manufacturing setups highlights the urgent need for enhanced scrutiny in software dependency management.

Socket's findings demonstrate how the malicious actors utilized typosquatting techniques to present their payloads as benign which not only facilitated their spread but delayed detection until it was too late for most organizations. The long-term activation timeline for these malicious codes effectively allows attackers to build a network of trusted users before executing their payloads. This strategy complicates incident response significantly: by the time the malicious code activates many developers may have left their projects exacerbating the challenge of tracking and remediating the origins of the malware.

This incident raises critical questions regarding supply-chain security in software development—particularly concerning how organizations manage and audit third-party packages. It underscores the necessity for enhanced vigilance and proactive measures in dependency management and the implementation of robust detection mechanisms that can identify not just malicious code but also potential vulnerabilities hidden within legitimate packages. Organizations should now prioritize establishing stringent security protocols auditing existing dependencies and educating developers on the risks associated with using unverified third-party libraries.