[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feqSnF3Ac6Z1U9n_S7Bt9n76GCIbTx31vAsDC1p02GGU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"09a66788-3c20-4f7d-8fbc-1e6de0113e66","net-11-hardens-nuget-and-container-pipelines-against-supply-chain-attacks","4fe80979-19e5-45a4-b561-de6739f2d7bc",".NET 11 Hardens NuGet and Container Pipelines Against Supply Chain Attacks","Microsoft's .NET 11 release directly addresses software supply chain risks by introducing a minimum package publication age for NuGet, creating a cooldown period that reduces the window for typosquatting and malicious package injection attacks. Without such controls, attackers can publish rogue packages and exploit the brief window before organizations or maintainers detect the threat. Reproducible container image digests further ensure that the artifact built is exactly the artifact deployed, closing a common integrity gap. These changes highlight how supply chain threats increasingly target the development toolchain itself, not just production systems.","**Immediate actions:**\n- Enable the new NuGet minimum package publication age setting in .NET 11 to enforce a cooldown period before new package versions can be consumed.\n- Pin container image references to verified, reproducible digests rather than mutable tags to ensure deployment integrity.\n\n**Long-term improvements:**\n- Implement a software composition analysis (SCA) tool in CI\u002FCD pipelines to continuously audit third-party and open-source dependencies.\n- Establish an internal package mirror or artifact proxy (e.g., Artifactory, Azure Artifacts) to vet and cache approved packages before developer use.\n- Maintain a Software Bill of Materials (SBOM) for all applications so newly discovered malicious packages can be rapidly identified across the portfolio.\n\n**Detection measures:**\n- Monitor NuGet and container registry consumption logs for unexpected new package versions or digest mismatches.\n- Set up alerts for any dependency introduced outside the approved internal mirror or artifact store.",[12,13,14,15,16],"NIS2 Article 21(2)(d)","NIST SP 800-53 SA-12: Supply Chain Protection","CIS Control 16: Application Software Security (v8)","MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools","NIST CSF 2.0 ID.SC-2: Suppliers and third-party partners of information systems",{"NIS2 Article 21(2)(d)":18,"NIST SP 800-53 SA-12: Supply Chain Protection":19,"CIS Control 16: Application Software Security (v8)":20,"MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools":21,"NIST CSF 2.0 ID.SC-2: Suppliers and third-party partners of information systems":22},"This point specifically requires organizations to address security risks in their supply chain, including software dependencies and package repositories, which is precisely what the NuGet cooldown and reproducible digest controls target.","SA-12 requires organizations to protect against supply chain threats by employing countermeasures throughout the system development lifecycle, directly covering the risk of malicious packages being injected via NuGet.","CIS Control 16 requires managing the security of software throughout its lifecycle, including vetting third-party components, which aligns with enforcing package age policies and verifying container image integrity.","This technique describes adversaries inserting malicious code into software dependencies (such as NuGet packages) to compromise downstream consumers, which the .NET 11 cooldown period is specifically designed to mitigate.","This category calls for identifying, assessing, and managing risks associated with suppliers and third-party software components, directly applicable to governing NuGet package consumption and container base images.","published","2026-11-12T09:20:38.678753+00:00","2026-11-12T09:20:38.657+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F12\u002Fnet-11-security-changes\u002F","net-11-security-changes-target-the-software-supply-chain-814bb2",".NET 11 security changes target the software supply chain",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49],{"slug":46,"name":47,"problem":48},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":50,"name":51,"problem":52},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]