> Markdown version of [/videos/938-how-your-net-software-supply-chain-is-open-to-attack-and-how-to-fix-it?t=3](https://www.wearedevelopers.com/videos/938-how-your-net-software-supply-chain-is-open-to-attack-and-how-to-fix-it?t=3). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# How your .NET software supply chain is open to attack : and how to fix it

Are malicious NuGet packages secretly compromising your .NET builds? Minor dependency oversights often lead to catastrophic network breaches. Learn to lock down your supply chain using strict configurations.

- **Speakers:** [Andrei Epure](https://www.wearedevelopers.com/@andrei-epure)
- **Event:** World Congress 2024
- **Published:** August 20, 2024
- **Duration:** 28:45
- **URL:** https://www.wearedevelopers.com/videos/938-how-your-net-software-supply-chain-is-open-to-attack-and-how-to-fix-it

## Summary

The software supply chain encompasses everything from source code to CI/CD infrastructure, but package managers have become a prime target for malicious exploitation. With hundreds of thousands of malware-laden packages discovered across registries like NuGet, NPM, Maven, and PyPI, attackers are increasingly focused on triggering remote code execution to exfiltrate proprietary source code, secrets, and environment credentials. This threat frequently succeeds because systemic continuous integration environments often run builds with elevated administrative privileges, turning minor dependency oversights into critical network breaches.

Two primary vectors dominate registry-based attacks: typo squatting and dependency confusion. Typo squatting preys on common keystroke errors by hosting lookalike packages that subtly bundle the legitimate library alongside malicious MSBuild targets—ensuring the build succeeds while silently compromising the host machine. Conversely, dependency confusion capitalizes on hybrid package source environments and parallel resolution mechanisms. Because default behavior fetches the fastest responding or highest versioned package across all available feeds, attackers can publish malicious public packages mirroring internal corporate naming conventions. By exploiting wildcard versioning rules, they force the build configuration to prioritize external exploits over legitimate internal code.

Securing the .NET ecosystem requires strict, explicitly declared constraints within the `nuget.config` file. Mitigating typo squatting relies on configuring signature validation mode to "require" and meticulously curating valid owners under trusted signers, which ensures packages must originate from explicitly verified authors rather than unvalidated accounts inheriting global registry certificates. Defeating dependency confusion necessitates the implementation of package source mapping to strictly lock internal namespaces to private organizational feeds. Furthermore, adopting foundational hygiene—using the `<clear />` tag to prevent inherited system feed defaults, stripping out floating package versions, and officially reserving company prefixes on the public package registry—drastically shrinks the attack surface and brings deterministic safety back to software supply builds.

**Keywords:** .net supply chain security, nuget configuration, package registry attacks, typo squatting vulnerabilities, dependency confusion, remote code execution, data exfiltration techniques, msbuild target exploits, signature validation mode, trusted signers configuration, package source mapping, floating version security risks, ci/cd pipeline zero-trust, nuget package namespace reservation, hybrid package feed resolution, malicious dependency defense

## Chapters

1. **Understanding software supply chain threats and security risks** (00:03) — The software supply chain encompasses all build tools and dependencies, which are increasingly targeted by data exfiltration attacks.
1. **How attackers exploit developers using typosquatting campaigns** (03:39) — Malicious packages rely on common typo variations to execute remote code when developers inadvertently download lookalike libraries.
1. **How a typosquatting attack triggers remote code execution** (06:51) — Mistyping a package name triggers remote code execution when manipulated build targets run directly from the local cache.
1. **Defending against typosquatting through nuget signature validation** (10:56) — Build environments can be protected by requiring signature validation mode and declaring trusted signers directly in configuration files.
1. **Explaining dependency confusion vulnerabilities in package resolution** (14:43) — Attackers exploit non-deterministic package resolution by publishing public repositories carrying private names to override internal dependencies.
1. **How wildcard versions trigger dependency confusion in nuget** (18:27) — Wildcard versioning and hybrid configuration sources can be manipulated to force the unintended installation of a public malicious package.
1. **Mitigating dependency confusion by using package source mapping** (21:34) — Administrators can restrict specific package namespaces strictly to intended public or private feeds by configuring package source mapping.
1. **Essential best practices for securing nuget package configurations** (23:16) — Engineering teams prevent supply chain attacks by reserving package prefixes, signing binaries, clearing system defaults, and inspecting new targets.

## Related Moments

- [Avoiding supply chain risks within standard software dependencies](https://www.wearedevelopers.com/videos/1829-how-to-defend-against-data-manipulation-attacks-bozidar-spirovski-wekoslav-stefanovski) (from "How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski")
- [Highlighting supply chain vulnerabilities from obfuscated package manager backdoors](https://www.wearedevelopers.com/videos/1284-dev-digest-end-of-year-recap) (from "Dev Digest End of Year Recap")
- [Identifying sophisticated supply chain attacks and simulated software vulnerabilities](https://www.wearedevelopers.com/videos/1859-things-you-don-t-know-about-cookies-and-how-to-protect-them-mohamed-shiralizadeh) (from "Things You Don't Know About Cookies and How to Protect Them - Mohamed Shiralizadeh")
- [Addressing supply chain attacks in package managers](https://www.wearedevelopers.com/videos/2131-evals-vs-evil-ai-and-package-security-laurie-voss) (from "Evals vs. Evil - AI and Package Security - Laurie Voss")
- [Exploring the mechanics of software supply chain attacks](https://www.wearedevelopers.com/videos/1841-wearedevelopers-live-bitpanda-s-ai-first-approach) (from "WeAreDevelopers LIVE - Bitpanda’s AI First Approach")
- [Mitigating dependency confusion in NPM packages](https://www.wearedevelopers.com/videos/724-security-in-modern-web-applications-owasp-to-the-rescue) (from "Security in modern Web Applications - OWASP to the rescue!")

## Related Articles

- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)

## Related Jobs

- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**
- [Senior Software Engineer, Enterprise Products](https://www.wearedevelopers.com/jobs/ext/1841248-senior-software-engineer-enterprise-products) at **GitHub**
- [Endpoint Security Engineer](https://www.wearedevelopers.com/jobs/ext/1962698-endpoint-security-engineer) at **ZEISS Group**