--- title: "Limit what NuGet packages can do in your project" url: https://daily.dev/posts/limit-what-nuget-packages-can-do-in-your-project-flxggyybc source_url: https://www.meziantou.net/limit-what-nuget-packages-can-do-in-your-project.htm type: article source: "Meziantou" published: 2026-08-24T12:13:43.867Z updated: 2026-08-24T12:14:06.614Z tags: ["security", ".net", "c#", "nuget"] reading_time: 3 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Limit what NuGet packages can do in your project **[Meziantou](https://daily.dev/sources/meziantou)** · 3 min read · 0 upvotes · 0 comments ## Summary NuGet packages can bring more than just runtime libraries: they can also include MSBuild props/targets and Roslyn analyzers that execute during restore, design-time build, or build, creating a supply-chain risk. The IncludeAssets and ExcludeAssets attributes on PackageReference let developers restrict which asset groups (compile, runtime, build, buildTransitive, analyzers, contentFiles) get imported. Examples cover including only runtime/compile assets, disabling analyzers while keeping the library, disabling build targets while keeping analyzers, and using a package purely for build tooling with PrivateAssets="all". Recommends testing after changing filters since some packages need their analyzers or build targets to function, and pairing this with lock files and package source mapping for stronger protection. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I stop a NuGet package from running its analyzers but still use its library? Add an ExcludeAssets element with the value 'analyzers' inside the PackageReference for that package in the csproj file. This keeps the runtime and compile assemblies available while preventing Roslyn analyzers and source generators from that package from running during the build. _daily.dev surfaces practical NuGet security patterns like this for developers hardening their build pipelines._ ### How can I use a NuGet package only for its MSBuild build targets without it becoming a runtime dependency? Set IncludeAssets to 'build;buildMultitargeting;buildTransitive' and add PrivateAssets="all" on the PackageReference. This imports only the build logic from the package while PrivateAssets="all" stops the dependency from flowing transitively to any project that references your project. _Developers wiring up build-only tooling dependencies can track NuGet configuration tips like this on daily.dev._ ### Why should I restrict which assets a NuGet package imports into my project? By default, NuGet imports every asset group from a package automatically, including MSBuild props/targets and Roslyn analyzers, which run during restore, design-time build, or build and can execute arbitrary code on your machine or CI. Restricting assets with IncludeAssets or ExcludeAssets reduces this attack surface, especially relevant given ongoing supply-chain attacks against package ecosystems. _daily.dev helps developers stay ahead of supply-chain risks tied to everyday dependency choices like NuGet packages._ ## Similar posts on daily.dev - [NuGet Package Pruning: Cleaner Dependencies and Actionable Vulnerability Reports](https://daily.dev/posts/nuget-package-pruning-cleaner-dependencies-and-actionable-vulnerability-reports-to2rg1k06) · .NET Blog · 30 upvotes · 0 comments - [Incremental Source Generators Done Right: Ship It Without Breaking Consumers — Daily DevOps & .NET](https://daily.dev/posts/incremental-source-generators-done-right-ship-it-without-breaking-consumers-daily-devops-net-jcaoono9a) · Daily DevOps & .NET · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#.net](https://daily.dev/tags/.net), [#c#](https://daily.dev/tags/c#), [#nuget](https://daily.dev/tags/nuget) [View this post on daily.dev](https://daily.dev/posts/limit-what-nuget-packages-can-do-in-your-project-flxggyybc)