What Is a .NUPKG File & How to Open It

NuGet Package (.nupkg)

Overview

A .nupkg file is a NuGet package: the unit of distribution for .NET libraries, tools, and templates. It is a ZIP archive following the Open Packaging Conventions (OPC), containing compiled assemblies, a manifest describing the package and its dependencies, and any supporting content.

Every package installed from nuget.org, or produced by dotnet pack, is one of these files. Because the container is ordinary ZIP, a .nupkg can be inspected with any archive tool without NuGet installed.

Technical Specifications

Format Details

MIME Type: application/zip
File Extensions: .nupkg, .snupkg (symbol packages)
Category: Package
Container: ZIP, per the Open Packaging Conventions (ECMA-376 Part 2)
Manifest: a .nuspec XML file at the archive root
Magic bytes: 50 4B 03 04 (PK\x03\x04)
Naming convention: PackageId.Version.nupkg

Identification

Like other OPC formats, a .nupkg is a ZIP file and detectors will report the ZIP signature. What identifies it specifically is the presence of a .nuspec file at the archive root alongside a [Content_Types].xml. The same container underlies Office documents and Java archives.

File Structure

Newtonsoft.Json.13.0.3.nupkg  (ZIP)
├── _rels/
│   └── .rels                        OPC relationships
├── package/
│   └── services/metadata/core-properties/*.psmdcp
├── [Content_Types].xml              OPC content-type map
├── Newtonsoft.Json.nuspec           the package manifest
├── README.md
├── LICENSE.md
└── lib/
    ├── net6.0/
    │   ├── Newtonsoft.Json.dll
    │   └── Newtonsoft.Json.xml      XML documentation
    ├── netstandard2.0/
    │   └── Newtonsoft.Json.dll
    └── net472/
        └── Newtonsoft.Json.dll

Conventional folders

lib/<tfm>/: assemblies referenced by consuming projects, one folder per target framework moniker.
ref/<tfm>/: reference-only assemblies used at compile time.
runtimes/<rid>/: platform-specific native or managed binaries.
build/: MSBuild .props and .targets files injected into the consuming project.
tools/: executables and PowerShell scripts, including .NET tool entry points.
content/ and contentFiles/: files copied into or linked from the consuming project.

The target framework moniker in the folder name is how a single package supports many .NET versions: the build picks the best matching folder for the project's target.

The .nuspec manifest

<?xml version="1.0" encoding="utf-8"?>
<package xmlns="http://schemas.microsoft.com/packaging/2013/05/nuspec.xsd">
  <metadata>
    <id>Example.Library</id>
    <version>2.1.0</version>
    <authors>Example Authors</authors>
    <description>A short description of the package.</description>
    <projectUrl>https://example.com/</projectUrl>
    <license type="expression">MIT</license>
    <repository type="git" url="https://github.com/example/library" commit="a1b2c3d" />
    <dependencies>
      <group targetFramework="net8.0">
        <dependency id="System.Text.Json" version="8.0.0" />
      </group>
    </dependencies>
  </metadata>
</package>

History and Development

NuGet launched in 2010 (briefly as NuPack) to give .NET the dependency management that Maven, RubyGems, and npm already provided. The package format reused OPC, which Microsoft had already standardised for Office documents, so existing ZIP and OPC tooling applied immediately.

Package authoring originally required hand-written .nuspec files and the nuget.exe CLI. With .NET Core, packing moved into the SDK: metadata lives in the .csproj, and dotnet pack generates the .nuspec automatically. Symbol packages later moved to the .snupkg format for publishing debug symbols separately.

Common Use Cases

Library distribution: publishing reusable .NET libraries to nuget.org or a private feed.
Internal package feeds: sharing shared code across teams via Azure Artifacts, GitHub Packages, or a local folder.
.NET tools: distributing command-line tools installable with dotnet tool install.
Project and item templates: packaging templates for dotnet new.
Build logic: shipping MSBuild targets that configure consuming projects automatically.

How to Open a NUPKG File

Inspect without installing anything

Rename the file to .zip, or point any archive tool at it directly:

# List contents
unzip -l Newtonsoft.Json.13.0.3.nupkg

# Read the manifest
unzip -p Newtonsoft.Json.13.0.3.nupkg Newtonsoft.Json.nuspec

# Extract everything
unzip Newtonsoft.Json.13.0.3.nupkg -d extracted/

On Windows, 7-Zip and the built-in Explorer ZIP handler both work after renaming.

With NuGet tooling

# Show what a package would bring in
dotnet add package Newtonsoft.Json --version 13.0.3

# Install from a local folder feed
dotnet nuget add source ./local-packages --name local

# Create a package from a project
dotnet pack -c Release

# Push to a feed
dotnet nuget push bin/Release/Example.Library.2.1.0.nupkg \
  --source https://api.nuget.org/v3/index.json --api-key "$NUGET_API_KEY"

GUI options

Visual Studio: the NuGet Package Manager UI and Package Manager Console.
NuGet Package Explorer: a dedicated Windows app for browsing and editing package contents and signatures.
JetBrains Rider: built-in NuGet browser.

Security Considerations

Packages can execute MSBuild logic and install tools, so they run code in your build. Prefer signed packages, pin exact versions in packages.lock.json, and use dotnet list package --vulnerable to check for known advisories. When using private feeds, be aware of dependency confusion: a public package with the same ID as an internal one can be resolved instead unless the feed mapping is configured explicitly.

Advantages

Standard container: inspectable with universal ZIP tooling.
Multi-targeting: one package serves many .NET versions.
Rich metadata: dependencies, licence, repository, and source-link information travel with the binary.
Deep toolchain integration: restore, pack, and publish are first-class SDK commands.

Limitations

Ambiguous by signature: indistinguishable from other ZIPs without reading the contents.
Executes build logic: packages carry MSBuild targets and scripts, which is a supply-chain surface.
Framework-moniker complexity: the TFM matching rules are subtle and a frequent source of confusion.
Size: packages targeting many frameworks duplicate assemblies for each one.

ZIP: the underlying container.
DOCX: another Open Packaging Conventions format.
JAR: the Java equivalent, also a ZIP with a manifest.
XML: the format of the .nuspec manifest.

What Is a .NUPKG File?