What does NuGet warning NU1507 mean, and how do I fix it?

NU1507 is a warning that NuGet logs when you use central package management and have more than one package source configured. NuGet is telling you that a package could come from several feeds. Fix it by adding package source mapping, or by reducing your configuration to a single source.

What the message says

The text reads like this: there are a number of package sources defined in your configuration, and when using Central Package Management you should map your package sources with package source mapping or specify a single package source.

It is not about a vulnerable package. It is a hygiene warning about how predictable your restore is.

Why NuGet cares

By default NuGet searches all configured sources when it needs a package. If the same package ID exists on more than one source, it may not be deterministic which one is used. That is the setup that dependency confusion attacks exploit: an attacker publishes a package on a public feed with the name of one of your internal packages.

Central package management makes versions explicit, which makes this gap more visible. A pinned version on an unpredictable source is still an unpredictable build.

Two ways to clear it

Fix with package source mapping

1. Put one nuget.config at the repository root.
2. Start with a clear element, then add each source.
3. Map internal prefixes to the private source and use the star pattern for the public one.
4. Run restore and fix any package that has no matching pattern.

<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="internal" value="https://nuget.example.internal/v3/index.json" />
  </packageSources>
  <packageSourceMapping>
    <packageSource key="nuget.org">
      <package pattern="*" />
    </packageSource>
    <packageSource key="internal">
      <package pattern="Contoso.*" />
    </packageSource>
  </packageSourceMapping>
</configuration>

The most specific pattern wins, and an exact package ID beats a prefix, which beats the star.

Do not silence it without fixing it

You can hide NU1507 with NoWarn. That removes the nudge but leaves the exposure. If you must suppress it for a short time, record the owner and a date to come back.

A quick verification

After mapping, clear the global packages folder and restore again. NuGet's own onboarding steps do this because packages already in the cache are used without a source lookup, so mappings are ignored for them. Consider a repository specific global packages folder for stronger effect.

Try it yourself

Click through it at your own pace, or open it full screen. Every package you see there, direct or transitive, needs a mapping once you turn mapping on.

Safeguard's dependency scanning and SBOM output list every package in the graph, and a free scan gives you the inventory to map against.

Quick check

Sources

• Central Package Management, Microsoft Learn
• Package Source Mapping, Microsoft Learn

Last reviewed: 19 October 2026.