FHN 
Microsoft has announced important security updates for NuGet.org aimed at improving software supply chain security and reducing the risk of compromised developer credentials being used to distribute malicious .NET packages.
Under the new policy, API keys created on or after August 17, 2026, will have a maximum lifetime of 30 days. Developers will no longer be able to create API keys that remain valid for 365 days. In addition, all API keys generated before August 17, 2026, will automatically expire on November 1, 2026.
The move is part of Microsoft’s broader effort to strengthen package security and encourage developers to adopt more secure authentication methods.
Why Is Microsoft Reducing API Key Lifetimes?
NuGet API keys are used by developers to publish packages to NuGet.org. These keys often function like passwords and are commonly stored in CI/CD pipelines, build servers, repository secrets, deployment environments, and other automation platforms.
Although this makes automated package publishing easier, it also creates an attractive target for cybercriminals. If attackers gain access to a long-lived API key, they could publish malicious packages under the name of a trusted project without immediately being detected.
By limiting API keys to just 30 days, Microsoft aims to significantly reduce the period during which a stolen credential can be exploited.
The Growing Risk of Supply Chain Attacks
Software supply chain attacks continue to rise as attackers increasingly target trusted software repositories instead of individual users.
Rather than directly attacking organizations, threat actors compromise developer credentials or package publishing accounts to insert malicious code into legitimate software packages. Once published, these compromised packages may be downloaded by thousands of developers and organizations, allowing malware to spread rapidly across multiple environments.
Microsoft explained that reducing the lifespan of publishing credentials is an important step toward minimizing this risk.
Recent Incidents Highlight the Threat
Microsoft referenced recent software package compromise incidents that demonstrate the dangers of stolen publishing credentials.
One notable example involved the NX Console package in the npm ecosystem. Attackers reportedly obtained valid publishing credentials and used them to release a malicious version of the package.
The compromised package was activated approximately 6,000 times within just 36 minutes before it was removed. This incident showed how quickly attackers can exploit trusted software repositories when publishing credentials fall into the wrong hands.
Events like these continue to reinforce the need for stronger authentication and shorter-lived credentials across software ecosystems.
Shorter API Keys Improve Security—but Don’t Eliminate the Risk
While reducing API key validity lowers the window of opportunity for attackers, Microsoft emphasized that shorter expiration periods alone cannot completely prevent credential theft.
API keys can still be exposed through several common scenarios, including:
- Source code repositories
- CI/CD pipeline logs
- Insecure secret storage
- Build servers
- Compromised developer workstations
- Accidentally shared configuration files
If an attacker obtains an active API key, they may still be able to publish malicious packages before the credential expires.
For this reason, Microsoft is encouraging developers to move beyond traditional API keys altogether.
Microsoft Recommends NuGet Trusted Publishing
To provide a more secure publishing process, Microsoft recommends using NuGet Trusted Publishing, which became available in September 2025.
Trusted Publishing replaces long-lived API keys with OpenID Connect (OIDC) authentication, allowing CI/CD platforms to securely verify their identity without permanently storing publishing credentials.
Instead of relying on reusable secrets, supported CI/CD services generate a temporary identity token during the publishing workflow.
NuGet.org validates this token against security policies configured by the package owner before issuing a temporary publishing credential that is valid only for that specific publishing operation.
This approach greatly reduces the chances of stolen credentials being reused by attackers.
How Trusted Publishing Works
The Trusted Publishing workflow is designed to eliminate long-lived secrets from automated publishing environments.
The process works as follows:
- A supported CI/CD platform generates a short-lived OIDC identity token.
- NuGet.org verifies the identity of the workflow.
- Repository, workflow, and optional environment details are validated against the package owner’s security policy.
- NuGet.org issues a temporary API key for that publishing session.
- Once the publishing job is complete, the temporary credential expires automatically.
Because no reusable API key is stored in repositories or CI/CD secrets, attackers have far fewer opportunities to steal publishing credentials.
Benefits of Trusted Publishing
Microsoft highlighted several advantages of adopting Trusted Publishing:
- Eliminates long-lived API keys.
- Reduces the risk of credential theft.
- Removes the need to store publishing secrets in repositories.
- Simplifies credential rotation.
- Improves software supply chain security.
- Limits the impact of compromised developer environments.
- Strengthens automated package publishing workflows.
GitHub Actions and GitLab users are encouraged to migrate to Trusted Publishing before the August 2026 deadline.
What Developers Should Do Before the Deadline
Organizations that continue using traditional NuGet API keys should begin preparing now.
Microsoft recommends the following actions:
- Review all NuGet publishing workflows.
- Identify API keys created before August 17, 2026.
- Update automation to support 30-day API key rotation.
- Restrict API keys to the minimum required package scope.
- Apply the least-privilege principle for publishing permissions.
- Avoid storing API keys in source code, configuration files, or logs.
- Immediately revoke any API key that may have been exposed.
- Begin migrating CI/CD pipelines to Trusted Publishing wherever possible.
Taking these steps can help reduce the risk of malicious package publishing while ensuring a smooth transition to the new policy.
Looking Ahead
Microsoft indicated that shortening API key lifetimes is only one phase of its long-term software supply chain security strategy. As support for Trusted Publishing expands across additional CI/CD platforms, the company may further reduce API key validity periods in the future.
Developers and organizations are encouraged to adopt modern authentication methods such as OpenID Connect to strengthen package security, reduce reliance on reusable secrets, and better protect the software supply chain against evolving cyber threats.
About the Author
