Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget"

The problem I have is that anyone can pretend to be someone else, by spoofing the owner field. This opens up a whole can of worms with regard to updates, and verifying the authenticity of every patch.

  1. Are these valid concerns? (did I miss any?)

  2. What technical and procedural controls can we implement to limit risk?

  3. Is there any way to use Nuget in a secure manner?

share|improve this question
up vote 3 down vote accepted

NuGet does not currently support code signing for package or nuspec files, so the author of the package cannot truly be identified. This issue was raised as a feature request in 2010, but it didn’t get much attention and hasn’t been implemented. See

Currently an already existing package NuGet can only be upgraded by the same account that it was originally uploaded by but this does not verify the actual author of the code which I believe is what you are getting at.

Outside of NuGet, code signing for assemblies still exists. Based on this I would suggest that you ideally:

  • Only use signed assemblies from a trusted publisher.
  • Use strong name references in your projects (which binds the project/assemblies to a specific public key).
  • Verify the signature for each assembly you download.

Possibly another concern is that a NuGet packages can have PowerShell install/uninstall scripts attached to it which are automatically run when using the NuGet package command-line. NuGet 1.4+ does support code signing for PowerShell scripts so I would suggest leaving PowerShell execution policy to RemoteSigned.

Alternatively don’t use NuGet and download the .msi/.exe from an official release and verify the signature on the file.

share|improve this answer

Since everything from the CLR to 3rd party libraries will be distributed via NuGet in ASP.NET vNext, the NuGet team has committed to supporting signed packages by, I believe, the time Visual Studio 2015 is released.

See the blog announcement:

Also, see the signing spec:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.