Microsoft Strengthens NuGet Supply Chain Security By Reducing API Key Lifetime

Microsoft is reducing the lifetime of NuGet.org API keys to strengthen supply chain security and reduce the risk of stolen credentials being used to publish malicious .NET packages. Starting August 17, 2026, newly created NuGet.org API keys will have a maximum validity period of 30 days. The platform will no longer allow publishers to create API keys with a 365-day lifetime. In addition, every API key created before August 17 will expire on November 1, 2026. NuGet API keys act much like passwords for publishing packages. Developers often save them as secrets on CI/CD platforms, in repository settings, on build servers, and in deployment configurations. While this enables automated publishing, it also creates a high-value target for...

Read the full article at the source.