NuGet Gallery
Depends
Confidence: Medium
Nothing to buy: if you build .NET, this is the default public package registry and you simply use it.
Comparison
NuGet Gallery and G2 both land on Depends.
Nothing to buy: if you build .NET, this is the default public package registry and you simply use it.
Buyers shortlisting B2B software should use G2 free as one input, cross-checked against Capterra or TrustRadius.
| Compare | NuGet Gallery | G2 |
|---|---|---|
| Verdict | Depends | Depends |
| Best for | .NET/C# developers | B2B software buyers shortlisting tools |
| Who it's not for | Anyone needing private or internal package hosting | Vendors without five-figure budgets |
| Privacy | Two CVEs against the Gallery itself (2024 input flaw, 2026 critical RCE), rising typosquatting pressure; the 2025 deletion incident was officially not a breach.⁶ | No public security page found; UpGuard reports no phishing; G2's own DPA references a past data breach.15 |
| Support quality | FAQ, status page, GitHub issues; no paid support. | Trustpilot and BBB complaints about G2's service |
| Public sentiment | Users treat as indispensable .NET infrastructure, but the 2025 package-deletion incident and supply-chain chatter eroded some trust.⁵ | Buyers find G2 useful for breadth, but sentiment on G2's own service skews negative on Trustpilot and Redditors weigh it against Capterra and Trustpilot. |
| Biggest gotcha | Typosquatting and dependency-confusion attacks are rising; double-check exact package names before installing.⁹ | Vendor contracts are negotiated and opaque; budget five figures annually before committing.16 |