Poisoned Pipeline

Poisoned Pipeline / Incidents / AS154

AS154 · 2026-05

Five NuGet packages impersonate Chinese UI libraries

NuGet

Socket: five malicious NuGet packages impersonate Chinese UI
libraries to distribute crypto-wallet and credential stealers.

Mapped techniques

supply-chain campaign

T0136 · Initial Access · Brandjacking

Chinese UI library names.

T0184 · Credential Access · Harvesting sensitive information from files

Wallets and creds.

Sources