--- title: Building a supply chain attack with .NET, NuGet, DNS,... description: A proof-of-concept walks through how a malicious NuGet package could be built to demonstrate a .NET supply chain attack. The author publishes a fake package... canonical: https://daily.dev/posts/building-a-supply-chain-attack-with-net-nuget-dns-source-generators-and-more--g3blnmja0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Building a supply chain attack with .NET, NuGet, DNS, source generators, and more! | daily.dev og:description: A proof-of-concept walks through how a malicious NuGet package could be built to demonstrate a .NET supply chain attack. The author publishes a fake package... og:url: https://daily.dev/posts/building-a-supply-chain-attack-with-net-nuget-dns-source-generators-and-more--g3blnmja0 og:image: https://api.daily.dev/og/posts/G3BlnMja0.png og:image:alt: Building a supply chain attack with .NET, NuGet, DNS, source generators, and more! og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Building a supply chain attack with .NET, NuGet, DNS, source generators, and more! **[Maarten Balliauw](https://daily.dev/sources/maartenballiauw)** · 13 min read · 0 upvotes · 0 comments ## Summary A proof-of-concept walks through how a malicious NuGet package could be built to demonstrate a .NET supply chain attack. The author publishes a fake package (MaartenBalliauw.StringExtensions) that hides a malicious class using EditorBrowsable, CompilerGenerated, and DebuggerHidden attributes, and executes code automatically via .NET 5's ModuleInitializer attribute. The code exfiltrates data by MD5-hashing the victim's machine name and performing a DNS lookup against a honeypot domain, avoiding more visible HTTP traffic. Alternative delivery techniques are shown using C# source generators (including CI-only code injection) and MSBuild .targets/.props files to inject code at build time. The piece closes with mitigation advice: watch for odd namespaces, monitor unexpected DNS/HTTP traffic, use private feeds to avoid dependency confusion, apply static analysis tools like WhiteSource and Snyk, and follow NuGet and Linux Foundation supply chain security guidance. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can a malicious NuGet package run code automatically without the developer calling it directly? It can use the ModuleInitializerAttribute, added in .NET 5.0, which tells the runtime to execute a method once when the assembly's module is loaded, typically the first time a type from that assembly is used. Combined with EditorBrowsable(Never), CompilerGenerated, and DebuggerHidden attributes, the method and its containing class can be hidden from IntelliSense, code analysis, and debuggers, letting malicious code run silently. _Developers vetting third-party packages can use daily.dev to stay sharp on .NET supply chain risks like this._ ### Why would a malicious package use DNS instead of HTTP to exfiltrate data? DNS requests are less likely to be monitored or blocked than HTTP traffic, since many networks lack auditing on DNS while proxy servers or tools like Application Insights would flag an HTTP dependency call. One demonstrated technique MD5-hashes the victim's machine name and performs a DNS lookup for a subdomain containing that hash against an attacker-controlled nameserver, letting the attacker log hits without triggering typical network monitoring. _Security-minded .NET teams tracking stealthy exfiltration techniques can follow coverage like this on daily.dev._ ### Can C# source generators be used to inject malicious code only during CI builds? Yes, a source generator can check environment variables like CI, TF_BUILD, or CI_SERVER during the Execute method and only emit malicious code when one of them is set, meaning the injected code appears only on the build server and never in a developer's local build output, making it harder for a project's own contributors to notice. _Teams auditing build pipelines for hidden code injection can use daily.dev to keep up with supply chain attack techniques._ ## Similar posts on daily.dev - [Four Malicious NuGet Packages Target ASP.NET Developers With...](https://daily.dev/posts/four-malicious-nuget-packages-target-asp-net-developers-with--57ffqqvc1) · Socket · 2 upvotes · 0 comments - [Modern supply-chain attacks and their real-world impact](https://daily.dev/posts/modern-supply-chain-attacks-and-their-real-world-impact-goucs5roh) · CSO Online · 0 upvotes · 0 comments - [Inside .NET Loader Analysis: From Malspam to In-Memory Loader](https://daily.dev/posts/inside-net-loader-analysis-from-malspam-to-in-memory-loader-tafajwltg) · Huntress Blog · 4 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#.net](https://daily.dev/tags/.net), [#appsec](https://daily.dev/tags/appsec), [#nuget](https://daily.dev/tags/nuget) [View this post on daily.dev](https://daily.dev/posts/building-a-supply-chain-attack-with-net-nuget-dns-source-generators-and-more--g3blnmja0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Building a supply chain attack with .NET, NuGet, DNS, source generators, and more!","url":"https://daily.dev/posts/building-a-supply-chain-attack-with-net-nuget-dns-source-generators-and-more--g3blnmja0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/building-a-supply-chain-attack-with-net-nuget-dns-source-generators-and-more--g3blnmja0"},"datePublished":"2026-10-04T13:04:07.722Z","dateModified":"2026-10-04T13:04:42.772Z","description":"A proof-of-concept walks through how a malicious NuGet package could be built to demonstrate a .NET supply chain attack. The author publishes a fake package...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f486894800341855b8160ec4bfe50bf2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f486894800341855b8160ec4bfe50bf2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Maarten Balliauw","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Maarten Balliauw","logo":"https://media.daily.dev/image/upload/s--rOTg3VYO--/f_auto,q_auto/v1791119043/logos/maartenballiauw?_a=BAMAMicg0","url":"https://daily.dev/sources/maartenballiauw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/building-a-supply-chain-attack-with-net-nuget-dns-source-generators-and-more--g3blnmja0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,.net,appsec,nuget","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Maarten Balliauw","item":"https://daily.dev/sources/maartenballiauw"},{"@type":"ListItem","position":3,"name":"Building a supply chain attack with .NET, NuGet, DNS, source generators, and more!"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/building-a-supply-chain-attack-with-net-nuget-dns-source-generators-and-more--g3blnmja0#faq","mainEntity":[{"@type":"Question","name":"How can a malicious NuGet package run code automatically without the developer calling it directly?","acceptedAnswer":{"@type":"Answer","text":"It can use the ModuleInitializerAttribute, added in .NET 5.0, which tells the runtime to execute a method once when the assembly's module is loaded, typically the first time a type from that assembly is used. Combined with EditorBrowsable(Never), CompilerGenerated, and DebuggerHidden attributes, the method and its containing class can be hidden from IntelliSense, code analysis, and debuggers, letting malicious code run silently. Developers vetting third-party packages can use daily.dev to stay sharp on .NET supply chain risks like this."}},{"@type":"Question","name":"Why would a malicious package use DNS instead of HTTP to exfiltrate data?","acceptedAnswer":{"@type":"Answer","text":"DNS requests are less likely to be monitored or blocked than HTTP traffic, since many networks lack auditing on DNS while proxy servers or tools like Application Insights would flag an HTTP dependency call. One demonstrated technique MD5-hashes the victim's machine name and performs a DNS lookup for a subdomain containing that hash against an attacker-controlled nameserver, letting the attacker log hits without triggering typical network monitoring. Security-minded .NET teams tracking stealthy exfiltration techniques can follow coverage like this on daily.dev."}},{"@type":"Question","name":"Can C# source generators be used to inject malicious code only during CI builds?","acceptedAnswer":{"@type":"Answer","text":"Yes, a source generator can check environment variables like CI, TF_BUILD, or CI_SERVER during the Execute method and only emit malicious code when one of them is set, meaning the injected code appears only on the build server and never in a developer's local build output, making it harder for a project's own contributors to notice. Teams auditing build pipelines for hidden code injection can use daily.dev to keep up with supply chain attack techniques."}}]} ```