Microsoft Strengthens NuGet Supply Chain Security By Reducing API Key Lifetime

Microsoft is reducing the lifetime of NuGet.org API keys to strengthen supply chain security and reduce the risk of stolen credentials being used to publish malicious .NET packages.

Starting August 17, 2026, newly created NuGet.org API keys will have a maximum validity period of 30 days. The platform will no longer allow publishers to create API keys with a 365-day lifetime. In addition, every API key created before August 17 will expire on November 1, 2026.

NuGet API keys act much like passwords for publishing packages. Developers often save them as secrets on CI/CD platforms, in repository settings, on build servers, and in deployment configurations. While this enables automated publishing, it also creates a high-value target for attackers.

If an adversary obtains a long-lived key, they may be able to publish a trojanized package under a trusted project name for months before the credential expires.

Microsoft Strengthens NuGet Supply Chain Security

Microsoft said the policy is part of a wider effort to reduce software supply chain risk. Other package ecosystems, including npm, have taken similar actions. The company cited recent package-compromise incidents involving stolen publishing credentials as an example of the potential impact.

A compromised package can quickly reach a large number of downstream developers and organizations. In one recent case involving the NX Console npm package, attackers reportedly used stolen credentials to publish a malicious release.

The package was activated 6000 times in only 36 minutes before it was removed. Such incidents show how a single exposed publishing credential can affect a broad software ecosystem.

The new policy will reduce the time during which a stolen NuGet API key remains useful. However, Microsoft warned that shorter expiration periods do not fully eliminate the risks associated with reusable secrets. A key can still be exposed through source code commits, CI/CD logs, insecure secret storage, or compromised developer systems.

Microsoft is recommending that package maintainers migrate to NuGet Trusted Publishing, which launched in September 2025. Trusted Publishing uses OpenID Connect, or OIDC, to authenticate a CI/CD workflow without storing a long-lived NuGet publishing key.

Under this model, a supported CI/CD platform creates a signed, short-lived identity token during a package-publishing job. NuGet.org validates the token against a policy defined by the package owner, including repository, workflow, and optional environment details. It then issues a temporary API key specifically for that publishing operation.

This workflow removes the need to place a reusable NuGet API key in a repository or CI/CD secret store. It also reduces the amount of secret rotation work and limits the damage from credential exposure. GitHub Actions and GitLab users are encouraged to begin moving to Trusted Publishing before the August deadline.

Maintainers who cannot yet adopt OIDC-based publishing should audit every NuGet publishing workflow, identify keys created before August 17, and update automation to support 30-day credential rotation.

They should also restrict keys to the minimum required package scope and permissions, avoid placing keys in code or logs, and revoke any exposed credential immediately.

Microsoft said API key lifetimes may be reduced further in the future as NuGet expands Trusted Publishing support across additional CI/CD environments.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.