Malicious NuGet packages, uploaded two years ago by the account “shanihai666,” hide harmful code in legitimate libraries, targeting databases and industrial PLCs. Discovered by Socket, these nine packages have been