Industrial IT systems are at risk of malicious NuGet package “ticking time bombs”

• Socket found nine NuGet packages with delayed sabotage targeting industrial control systems
• Sharp7Extend may corrupt Siemens S7 PLCs and randomly crash host processes
• Malicious code is activated in 2027-2028; Users are urged to audit and remove affected packages.

Thousands of critical infrastructure organizations, as well as those working in other equally important vertical sectors, were the target of a malicious attack that sought to sabotage their industrial control devices (ICD) two years later, experts discovered.

Socket cybersecurity researchers recently found nine packages on NuGet that contained sabotage payloads that would activate in 2027 and 2028, if certain conditions were met.