Try our conversational search powered by Generative AI!

Daniel Ovaska
Feb 25, 2021
(1 votes)

Security issue with multiple package sources


You are using a private nuget feed for a single package v 1.0.0 and a public nuget feed for the rest of your packages. An attacker can then upload a new package to public nuget feed using the same name as your private package but with a higher bug fix version v 1.0.1. Unless you have thought about this scenario your build server will look across all package sources and pick the most updated version (the faked 1.0.1 version on the public feed). So if you are using a private package source you are still not safe unless that is the only source you are using for your packages.


More detailed information can be found here about this vulnerability ( along with suggestions for how to mitigate the risks.

For high security scenarios:

  • Use one feed. If you have a private feed with internal packages, make that the only feed and add secure handling of public packages to that feed if you need. All projects should then use that one safe feed. is a good option that can deliver that if you don't want to create your own.

Additional mitigation:

  • Lock down your versions and make sure your build server can't update minor version automatically.
    Both npm and nuget can generate such a lock file easily that can then be used to force build server to use a specific version of all dependencies. Use nuget restore --lockedmode on CI servers to use the lock file.
  • Make sure one package can only be downloaded from one source.
    Use scope and npmrc file for npm to specify source per package. Use id prefix for nuget packages to block private packages from being uploaded to public feeds.

This is not an Episerver specific vulnerability but good to be aware of if security is important for your site.

I've added it to my security checklist for Episerver solutions, If you haven't gone through that for your site, I would suggest starting at the top and work your way down until you reach a decent level for your security requirements. 

Stay safe, don't get hacked! Happy coding!

Feb 25, 2021


Please login to comment.
Latest blogs
Optimizely Web... 6 Game Changing Features in 2024

If you are interested in learning about what's new within Optimizely Web, you are in the right place. Carry on reading to learn about the 6 greates...

Jon Jones | Mar 3, 2024 | Syndicated blog

Headless forms reloaded (beta)

Forms is used on the vast majority of CMS installations. But using Forms in a headless setup is a bit of pain since the rendering pipeline is based...

MartinOttosen | Mar 1, 2024

Uploading blobs to Optimizely DXP via PowerShell

We had a client moving from an On-Prem v11 Optimizely instance to DXP v12 and we had a lot of blobs (over 40 GB) needing uploading to DXP as a part...

Nick Hamlin | Mar 1, 2024 | Syndicated blog

DbLocalizationProvider v8.0 Released

I’m pleased to announce that Localization Provider v8.0 is finally out.

valdis | Feb 28, 2024 | Syndicated blog