NuGet Package Manager Under Attack: How Homoglyph Typosquatting Targets .NET Developers - October 2025
The Attack That Fooled My Eye (And Probably Yours Too)
First, when I saw the package name "Netherеum.All" in today's NuGet breach report, I almost missed it. Security researchers from Socket discovered this sophisticated typosquatting campaign where attackers uploaded malicious packages impersonating Nethereum, the standard .NET library for Ethereum development. What makes this particularly concerning, from my experience in securing different environments, is how the attackers combined multiple deception techniques.
Why This Attack Succeeded (And Will Again)
The Perfect Storm of Trust Signals
The malicious package "Netherеum.All" was uploaded on October 16, 2025, and artificially inflated to show 11.7 million downloads before being removed four days later. I've seen and read how developers rely on download counts as credibility indicators — exactly what these attackers exploited.
The Technical Sophistication
The malware used an XOR-decoded runtime command-and-control mechanism hidden within the EIP70221TransactionService.The shuffle method is designed to exfiltrate mnemonic phrases, private keys, and keystore data. From a security architecture perspective, this isn't your typical script kiddie operation — this required a deep understanding of .NET development workflows.
The Unicode Loophole
Unlike PyPI and npm, which restrict package names to ASCII characters, NuGet allows Unicode characters, enabling the Cyrillic homoglyph substitution that made "Netherеum" appear identical to "Nethereum" at casual glance.
My personal advice
Immediate Actions:
- Audit Your Dependencies: Run the dotnet list package on all projects and verify every Nethereum-related package. Look for any packages installed between October 16 and 20, 2025.
- Implement Package Verification: Start requiring digital signature verification for all NuGet packages in your CI/CD pipeline. This is non-negotiable after seeing this attack.
- Review Cryptocurrency Exposure: If your applications handle cryptocurrency operations, assume compromise and rotate all keys, mnemonics, and keystore passwords immediately.
Strategic Security Measures (30-day implementation):
From my experience implementing secure SDLC practices, I see that you need private package repositories with allowlisting. This attack demonstrates how governance gaps in open-source registries create systematic vulnerabilities that developer vigilance can't solve alone.
The Bigger Development Security Problem
This campaign included two attacks — an earlier "NethereumNet" typosquat and the recent homoglyph attack, both using identical exfiltration codebases. What worries me most is the systematization: these weren't opportunistic attacks but coordinated campaigns targeting the cryptocurrency development ecosystem. This type of data loss for businesses in FinTech, digital identity, or Web3 leads to financial catastrophe and destroys customer trust.
Why Traditional Defenses Failed
The malicious code remained hidden until specific methods were called, allowing applications to compile and function normally while quietly exfiltrating sensitive data. This is precisely why I recommend runtime application security monitoring for all cryptocurrency-related applications — static analysis alone won't catch these behavioral attacks.
Developer Trust Exploitation
By including legitimate dependencies like Nethereum.Hex and Nethereum.Signer, the malicious package ensured applications would function as expected, masking the malicious activity. From a threat modeling perspective, this attack leveraged the implicit trust developers place in functional code.
My Recommendations for .NET Teams
- Package Source Restrictions: Configure NuGet to only allow packages from verified, corporate-controlled sources
- Automated Security Scanning: Implement tools that can detect homoglyph attacks and unusual download patterns
- Cryptocurrency Key Management: Never store crypto credentials in development environments — use hardware security modules
- Regular Security Audits: Schedule quarterly reviews of all open-source dependencies
The sophistication of this attack tells me we'll see more like it. The combination of Unicode exploitation, artificial trust signals, and targeted cryptocurrency theft represents a new category of supply chain threats that traditional security tools aren't designed to catch.
Bottom Line: If you're developing .NET applications that handle cryptocurrency, this attack should be your wake-up call to implement enterprise-grade dependency security.
References:
