How to obfuscate a NuGet package before you publish it

If you distribute a commercial .NET library on NuGet, anyone who installs it can open your DLL in a decompiler and read your implementation. You can protect it — the trick is protecting the internals while keeping the public API your consumers call intact. Nebula handles the whole package for you.

The one rule: keep your public API

Consumers reference your library by its public types and members. If obfuscation renamed those, their code wouldn’t compile against your package. So for a library the golden setting is preserve public API — public/protected names stay, everything internal is renamed, flattened and encrypted.

Step 1 — point Nebula at the package

You don’t have to unpack anything. Give Nebula the .nupkg directly and it obfuscates the assemblies inside and repacks a protected package:

{
  "inputs": ["bin/Release/MyLib.1.2.3.nupkg"],
  "outputDirectory": "protected",
  "preservePublicApi": true,
  "controlFlowObfuscation": true,
  "encryptStrings": true
}

nebula --config nebula.config.json

The protected MyLib.1.2.3.nupkg lands in protected/, ready to push.

Step 2 — if you ship multiple libraries

Products often span several packages that call each other’s public members. If you want to rename across them, obfuscate them together so the cross-references are rewritten consistently — otherwise renaming a public member in one breaks the others. Add all the assemblies to inputs and enable crossAssemblyRename. See Multiple assemblies.

Step 3 — mind reflection and serialization

Auto-detect preserves types and members referenced by reflection or carrying serialization attributes (System.Text.Json, Newtonsoft, DataContract, XML). If your library exposes DTOs that consumers serialize, keep those attributes (or exclude the DTOs) so the wire format doesn’t change. See Keeping your app working.

Step 4 — sign and verify

Strong-name signing must be re-applied after obfuscation — set strongNameKeyFile and Nebula signs the protected output. Then install the protected package into a throwaway consumer project and run your tests against it: the public API compiles and behaves exactly as before, but the internals are now hard to read.

Automate it in your release pipeline

Wire this into CI so every published package is protected, without touching your source. See MSBuild & CI.

Download Nebula.NET free and protect your next NuGet release.