Poisoned Pipeline / Incidents / AS188

AS188 · 2025-10

Non-npm registry one-offs (NuGet, Maven xz, Laravel Packagist, evm-units)

NuGetMaven / JavaPackagist / Composercrates.io

Socket: NuGet Nethereum typosquats and .NET tracing-library typosquat,
nine time-delayed destructive NuGet packages, Maven package impersonating
xz-for-java, Packagist Laravel-utility RATs, Rust crate evm-units.

Mapped techniques

• T0129 Typosquatting
• T0109 Publish malicious artifact
• T0172 Runtime backdoor

supply-chain campaign

Sources

• https://socket.dev/blog/malicious-nuget-packages-typosquat-nethereum-to-exfiltrate-wallet-keys
• https://socket.dev/blog/malicious-nuget-package-typosquats-popular-net-tracing-library
• https://socket.dev/blog/9-malicious-nuget-packages-deliver-time-delayed-destructive-payloads
• https://socket.dev/blog/malicious-maven-package-impersonating-xz-for-java-library
• https://socket.dev/blog/malicious-packagist-packages-disguised-as-laravel-utilities
• https://socket.dev/blog/malicious-rust-crate-evm-units-serves-cross-platform-payloads