# 5 NuGet packages impersonate Chinese .NET UI libraries with infostealer payload

> NuGet publisher `bmrxntfj` shipped five packages on 14 April 2026 within ~13 seconds, grafting a .NET Reactor-protected infostealer onto decompiled legitimate libraries. Across 219 total versions they accumulated ~65k downloads, targeting browser creds, crypto wallets, and SSH keys on Windows .NET dev hosts.

- Published: 2026-04-14
- Severity: high
- Kind: Typosquat - A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK.
- Ecosystems: NuGet
- Scope: 5 packages, 5 compromised versions
- Tags: typosquat, infostealer, crypto-wallet-drain, obfuscation, credential-theft
- Detected by: Socket
- Incident ID: nuget-2026-04-14-chinese-ui-impersonators

## Affected packages (5)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [IR.DantUI](https://dependencywatch.io/package/nuget/IR.DantUI) | NuGet | 2.1.55 |
| [IR.Infrastructure.Core](https://dependencywatch.io/package/nuget/IR.Infrastructure.Core) | NuGet | 2.1.55 |
| [IR.Infrastructure.DataService.Core](https://dependencywatch.io/package/nuget/IR.Infrastructure.DataService.Core) | NuGet | 2.1.55 |
| [IR.iplus32](https://dependencywatch.io/package/nuget/IR.iplus32) | NuGet | 2.1.55 |
| [IR.OscarUI](https://dependencywatch.io/package/nuget/IR.OscarUI) | NuGet | 2.1.55 |

## What happened

Socket's threat research team disclosed five NuGet packages pushed by publisher `bmrxntfj` on 14 April 2026 within a 12–13 second window. The packages impersonate Chinese-language .NET UI libraries (DantUI, OscarUI, an "Infrastructure" framework) and graft a **.NET Reactor-protected** infostealer onto decompiled copies of the genuine libraries so functionality looks intact.

Execution is automatic on `nuget restore` via a module-initializer JIT hook - no explicit API call by the consumer is required. The stealer targets 12 browsers, 8 cryptocurrency wallets, SSH keys and arbitrary local files. A second-stage encrypted payload is staged at `C:\ProgramData\Microsoft OneDrive\keys.dat`.

- C2 domain: `dns-providersa2.com` (registered 2026-03-12, Njalla privacy registrar).
- C2 IP: `62.84.102.85` (VDSINA, ASN 216071, Amsterdam) with `/check` and `/upload` endpoints.
- Dev / staging infra: `git.justdotrip.com` / `47.100.60.237` (Alibaba Cloud).
- Shared .NET Reactor RSA-1024 key (base64 prefix `zlUkMywGKDNbeJxH`) ties the five packages and 219 historical versions together.

Accumulated downloads across all versions reach roughly **64,784** since September 2025. After Socket's analysis began, the operator rotated to version `2.1.57` - defenders should treat the entire `IR.*` publisher namespace as untrusted rather than relying on a single fixed version.

## Impact

- Browser cred and wallet theft on Windows .NET dev hosts
- Encrypted secondary stage staged at `C:\ProgramData\Microsoft OneDrive\keys.dat`
- Targets Chinese-speaking .NET developers via UI-library impersonation

## What to do

1. Remove listed packages from any .NET project
2. Treat credentials and wallets on affected workstations as compromised
3. Block dns-providersa2.com and git.justdotrip.com at egress

## References

- [5 malicious NuGet packages impersonate Chinese UI libraries](https://socket.dev/blog/5-malicious-nuget-packages-impersonate-chinese-ui-libraries) - Socket

---

Canonical page: https://dependencywatch.io/incident/nuget-2026-04-14-chinese-ui-impersonators
Markdown version: https://dependencywatch.io/incident/nuget-2026-04-14-chinese-ui-impersonators.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).