Microsoft is shortening the lifespan of API keys on NuGet.org to enhance supply chain security and mitigate the risk of compromised credentials being utilized for publishing malicious .NET packages This article explores keys nuget org. . Automated publishing is often configured by developers with secrets stored on CI/CD platforms, repository settings, build servers, and deployment configurations.
An attacker with a long-lived key could publish trojanized packages under trusted project names for long periods of time before the credentials expire. As part of broader efforts to mitigate risks in the software supply chain, Microsoft has enhanced NuGet supply chain security. A recent case saw attackers using the NX Console npm package to publish a malicious release 6000 times in 36 minutes, before it was removed.
A key could also be leaked through source code commits, CI/CD logs, insecure secret storage, or a compromised developer machine. NuGet.org checks the token against policies set by the owner of the package, such as repository, workflow and optional environment data. If you haven't migrated to OIDC-based publishing, we recommend doing a full audit of all your NuGet workflows to identify any keys created before August 17th and to update automation to support a 30 day credential rotation policy.
They also need to minimize key scope and permissions, limit keys to the minimum package level needed, avoid storing them in code or logs, and promptly revoke any exposed credentials. -> Integrate ANYRUN With Your SOC Now.
