A recent security incident has highlighted the risks associated with typosquatting in software package repositories. A malicious NuGet package named Newtonsoftt.Json.Net was discovered impersonating the widely used Newtonsoft.Json library. This counterfeit package was designed to manipulate the outcomes of betting games by targeting specific backend systems.
Typosquatting involves creating packages with names that closely resemble legitimate ones, exploiting the likelihood of developers making typographical errors during installation. In this case, the addition of an extra ‘t’ in Newtonsoftt and the misleading ‘.Net’ suffix made the malicious package appear authentic. Developers who inadvertently installed this package received a functional JSON library, allowing the malicious code to operate undetected while applications continued to function normally.
Security researchers at JFrog identified that the Newtonsoftt.Json.Net package specifically targeted the backend of Digitain’s FG-Crash betting game. Unlike broad-spectrum attacks aimed at credential theft or system disruption, this campaign was tailored for precision fraud, altering game results to favor the attacker. The package was available on the NuGet repository from August through October 2025 and was unlisted after its discovery. However, its artifacts remained accessible at the time of the research.
Mechanism of the Malicious Package
The malicious package closely mimicked the legitimate Newtonsoft.Json library by listing James Newton-King as the author, using a familiar project URL, and adopting a believable versioning pattern (11.0.x). Within the package were a trojanized JSON assembly, a payload DLL named Newtonsoft.Values.Net.dll, and the legitimate HarmonyLib runtime-patching component.
NuGet’s default behavior of referencing assemblies in the lib\net8.0 directory allowed the malicious payload to be loaded without explicit developer action. The code remained dormant until the application configured JsonConvert.DefaultSettings, at which point it replaced the application’s JSON resolver with its own. To evade detection, the payload delayed its activation, reducing the likelihood of suspicious behavior during application startup.
Once active, the payload utilized Harmony to modify the GenerateGameResult method associated with Digitain’s Crash-style game. Early versions altered compiled instructions, while later variants directly replaced the returned results with attacker-specified values based on time, date, and preset tables. The threat actor released seven versions across three generations, each introducing changes to enhance the attack’s effectiveness.
Implications and Preventative Measures
This incident underscores the critical importance of vigilance when managing software dependencies. Developers should meticulously verify package names and sources before installation to prevent inadvertently introducing malicious code into their applications. The use of automated tools to detect typosquatting and other supply chain attacks can provide an additional layer of security.
As software supply chain attacks become more sophisticated, the industry must prioritize the development and adoption of robust security practices. This includes implementing stricter controls on package repositories, enhancing monitoring mechanisms, and fostering a culture of security awareness among developers. By taking proactive measures, the risk of similar attacks can be mitigated, ensuring the integrity and reliability of software systems.
