Microsoft shortens NuGet.org API key lifetimes to 30 days for supply-chain hardening (effective Aug 17, 2026) — Threadlinqs Intelligence
As of 2026-08-04, Microsoft shortens NuGet.org API key lifetimes to 30 days for supply-chain hardening (effective Aug 17, 2026) is a medium-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-1876 · Severity: MEDIUM · Status: ACTIVE · Category: SUPPLY_CHAIN
Microsoft is strengthening NuGet.org supply-chain security by reducing the maximum validity of newly created NuGet.org API keys from 365 days to 30 days, effective August 17, 2026. All API keys
On August 4, 2026, Microsoft announced a significant hardening of NuGet.org package publishing security: the maximum validity of newly created NuGet.org API keys will be reduced from 365 days to 30 days, effective August 17, 2026. All API keys created before that date will be forcibly expired on November 1, 2026. This change eliminates the 365-day key duration option and is intended to reduce the damage window of stolen or leaked publishing credentials.
NuGet.org API keys function as passwords for publishing packages. Developers commonly store them as secrets in CI/CD platforms, repository settings, build servers, and deployment configurations. A stolen long-lived key enables an attacker to publish trojanized package updates under a trusted project name for months before the credential expires or is noticed. The problem is cross-ecosystem: npm experienced the same pattern with the ua-parser-js, coa, and rc package takeovers (October–November 2021), where stolen maintainer credentials via credential stuffing were used to publish DanaBot password-stealing trojans and XMRig cryptominers. PyPI, RubyGems, and crates.io have all faced similar credential-theft supply-chain incidents.
Two specific incidents drove the urgency of the NuGet policy change. First, the Nx Console supply-chain compromise (CVE-2026-48027, GHSA-c9j4-9m59-847w) on May 18, 2026: an attacker published a malicious Nx Console VSCode extension version (v18.95.0) after exfiltrating a contributor’s GitHub CLI OAuth token. The theft originated from the upstream TanStack npm compromise (CVE-2026-45321, GHSA-g7cv-rxg3-hmpx) on May 11, 2026, where 84 malicious @tanstack/* packages were published with valid npm provenance. When a Nx contributor ran pnpm install in an external repo, a malicious prepare script executed a 2.3 MB obfuscated credential harvester that exfiltrated the contributor’s gh CLI token from ~/.config/gh/hosts.yml within 74 seconds. The attacker then spent 5+ days with the stolen token deleting CodeQL workflow runs and planting orphan commits before publishing the malicious extension, which was activated approximately 6,000 times in 36 minutes across VS Code and Cursor installations. The root cause chain included four compounding failures: an upstream dependency compromise with valid provenance, a silent minimum-release-age bypass (pnpm 10.14 silently ignored the 7-day release-age policy in .npmrc because the feature only shipped in pnpm 10.16+), gh CLI credentials readable by any local process, and a single-actor publishing pipeline lacking approval gating.
Second, concurrent research by Socket’s Threat Research Team identified five malicious NuGet packages published under the account bmrxntfj that typosquat Chinese .NET UI libraries (AntdUI-derived). The packages — IR.DantUI, IR.OscarUI, IR.Infrastructure.Core, IR.Infrastructure.DataService.Core, and IR.iplus32 — carry a .NET Reactor-protected infostealer targeting credentials from 12 Chromium-based browsers, 8 desktop cryptocurrency wallets, 5 browser wallet extensions (MetaMask, TronLink, Phantom, Trust Wallet, Coinbase Wallet), SSH private keys, and cloud service credentials. The payload fires via the CLR module initializer, patches clrjit.dll!getJit to hijack the JIT compiler, and executes a 786 KB MSIL assembly (we4ftg.exe) recovered from live memory dumps. The operator uses version rotation evasion — 219 of 224 total versions carry listed: false, keeping only one version visible at a time while invalidating file-hash-based IOCs. The C2 domain dns-providersa2.com (registered 2026-03-12 via Njalla privacy registrar, hosted at 62.84.102.85 on VDSINA/ASN 216071 in Amsterdam) serves /check (beacon) and /upload (exfiltration) endpoints. Data is staged at C:\ProgramData\Microsoft OneDrive\keys.dat before exfiltration. The packages have accumulated approximately 64,784 total downloads since September 2025 and remain live on NuGet.org.
Microsoft’s recommended alternative to API keys is NuGet Trusted Pu
Weaknesses (CWE)
CWE-287, CWE-522, CWE-312
Target sectors: software, technology, open-source, cloud, finance
Target regions: Global
Detections & IOCs
As of 2026-08-15, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, MEDIUM, threat intelligence, cybersecurity, T1195.001, T1195.002, T1078, T1059.007, T1543.001, T1548.003, T1027.005, T1140, T1685, T1055
