Socket: 5 Malicious NuGet Packages Target Chinese .NET Developers

What it is

Five malicious NuGet packages published by account bmrxntfj, all still live at time of writing: IR.DantUI and IR.OscarUI (impersonating AntdUI, an MIT WinForms library on Gitee), plus IR.Infrastructure.Core, IR.Infrastructure.DataService.Core, and IR.iplus32 (mimicking internal Chinese enterprise libraries). Rather than typosquatting public package names, they impersonate privately/internally distributed libraries that target orgs may already consume, making the IDs plausible in Chinese enterprise .NET environments.

How it works

Each package is a decompiled copy of a legitimate library with a .NET Reactor–protected stealer grafted on. Execution triggers from the .NET module initializer, which the CLR runs automatically before any application code — no API call, user interaction, or Visual Studio session needed. On DLL load the Reactor bootstrap: verifies Anti-Tamper via an embedded RSA-1024 key, allocates RWX memory with VirtualAlloc(PAGE_EXECUTE_READWRITE), decrypts the Necrobit stage-2 IL blob, then patches clrjit.dll!getJit with a 4-byte JMP. That hook owns every subsequent method compilation, decrypting each method body on demand so the library both compiles cleanly and runs the payload. Cross-platform paths are fully wired: Linux uses /proc/self/mem, mmap, mprotect; macOS resolves libSystem/libclrjit symbols for the same primitives.

Preconditions / Affected

Any build server, CI runner, or workstation that runs nuget restore and then loads one of the assemblies — on Windows, Linux, or macOS. No debugger or interactive session required. Reactor Necrobit decrypt stubs appear as return null; in decompiled output; Windows P/Invoke names use string-split assembly to defeat static string matching.

What to do

Hash-based IOCs do not work here — this is the key operational point. The operator rotates versions (2.1.55 → 2.1.56 → 2.1.57 observed) so blocking a specific DLL hash misses the next release. The account has 224 total versions, 219 unlisted (listed: false) but still fetchable via version-pinned installs, with only one version listed per package at a time. Block by package ID / publisher account, not by hash. Audit lockfiles and CI logs for any IR.DantUI, IR.OscarUI, IR.Infrastructure.Core, IR.Infrastructure.DataService.Core, or IR.iplus32 reference — including version-pinned installs of unlisted versions. Socket has submitted NuGet takedown requests but all five remained available.

Caveats

Only the AntdUI-derived packages are confirmed against upstream: a diff of DantUI/Svg/Transforms/SvgTransform.cs shows every AntdUI.* namespace renamed to DantUI.*, method bodies replaced by decrypt stubs, and a 230-field Reactor state machine injected into static constructors. The three infrastructure packages have no confirmed public upstream, so the "repackaged legitimate code" claim rests on the two UI packages. The seven-month campaign duration is inferred from the version-rotation pattern, not directly logged. The fetched page cuts off mid-sentence on the P/Invoke evasion detail.