Cybersecurity researchers have discovered a sophisticated typosquatting attack on the NuGet package repository. The package, named "Newtonsoft.Json," is a trojanized fork of the legitimate library designed not to steal information, but to rig live game results on the Digitain online betting platform.
Seven versions of the malicious package were published to the NuGet repository between August and October 2025, and the package has been downloaded approximately 1,200 times to date. While the package has since been unlisted by its owner, the artifacts remain available for download. The discovery highlights a new class of software supply chain attack that goes beyond traditional info-stealing malware.
How the Attack Works
According to JFrog security researcher Guy Korolevski, the trojan is designed to be extremely targeted. "Developers who install it by typo get a real, working Newtonsoft.Json build; the malicious behavior begins after the host initializes JsonConvert.DefaultSettings, and can only succeed on systems that expose the target's specific game backend method," he explained.
The malware initiates itself via the DefaultSettings property setter, which has been altered to introduce a randomized delay to sidestep detection. It then targets servers running Digitain's crash-game backend and exfiltrates rigged results to an attacker-controlled server while masquerading as telemetry data. The primary victim of the rigging is Digitain, the operator of the FG-Crash betting game. The package metadata has been found to leak an internal Digitain repository URL seven times, indicating the author had access to the source code of the target platform.
Iterative Development
The researchers noted that the package evolved through three generations. The progression showed the author iteratively hardening the payload, moving from a local-only proof of concept to adding exfiltration and finally cleaning up the rigging and stabilizing the exfiltration path. The final version was left completely unobfuscated, which the researchers believe may have been an accidental clean build.
To counter the threat, developers are advised to remove the typosquat package, block the command-and-control address, and pin Newtonsoft.Json to a known-good version. Digitain has confirmed it is aware of the issue and has taken steps to resolve it, though the full extent of the exposure remains unknown.