Poisoned Pipeline / Incidents / AS166

AS166 · 2026-03

Four NuGet packages JIT-hook ASP.NET credential theft

NuGet

Socket: four malicious NuGet packages target ASP.NET developers with JIT hooking and credential exfiltration.

Mapped techniques

• T0109 Publish malicious artifact
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://socket.dev/blog/four-malicious-nuget-packages-target-asp-net-developers-with-jit-hooking-and-credential