A Single Extra “t” in a NuGet Package Allow Attackers to Manipulate Results

A malicious NuGet package used a single extra letter to hide in plain sight, turning a familiar software dependency into a betting-fraud tool.

The package, Newtonsoftt.Json.Net, copied the appearance of the widely used Newtonsoft.Json library while carrying code designed to alter game outcomes.

The campaign relied on typosquatting, a tactic that exploits small spelling mistakes made during package installation.

Developers who selected the counterfeit package received a working JSON library, allowing the threat to remain hidden while affected applications continued operating as expected.

Researchers at JFrog identified the package and found that it specifically targeted Digitain’s FG-Crash betting-game backend.

JFrog said in a report shared with Cyber Security News (CSN) that the package was built for precision fraud rather than broad credential theft or destructive activity.

The malicious package was available on NuGet from August through October 2025 and was later unlisted, although its artifacts remained downloadable at the time of the research.

The incident reinforces why developers should verify package names and origins, particularly after recent malicious NuGet packages targeting developers showed how trusted dependency ecosystems can be abused.

Typosquat Package Alters Game Results

The name Newtonsoftt.Json.Net differs from the genuine library by only one additional “t” and a misleading .Net suffix.

Its metadata imitated the genuine project by listing James Newton-King as author, using a familiar project URL, and presenting a believable 11.0.x versioning pattern.

Inside the package were a trojanized JSON assembly, a payload DLL named Newtonsoft.Values.Net.dll, and the legitimate HarmonyLib runtime-patching component.

Since NuGet automatically references assemblies stored under the package’s lib\net8.0 directory, an application could load the malicious payload without a developer deliberately calling it.

The code waited until an application configured JsonConvert.DefaultSettings, then replaced the application’s chosen JSON resolver with its own.

It scheduled its patch after a delay, reducing the chance that developers would see suspicious behavior during startup, much like techniques described in a malicious NuGet logging package investigation.

Once active, the payload used Harmony to modify GenerateGameResult, a method connected to Digitain’s Crash-style game.

Earlier versions changed compiled instructions, while later variants directly replaced the returned result with attacker-selected values based on time, date, and preset tables.

The threat actor released seven versions across three generations, gradually changing obfuscation, result-rigging methods, and data-exfiltration capabilities.

This evolution shows how a targeted supply-chain intrusion can be refined over time, echoing the wider risks seen in open source package attacks.

Delayed Fraud and Data Theft

The newest identified version, 11.0.11, sent manipulated results to an attacker-controlled server using a request shaped to resemble Seq logging traffic.

It used the /api/events/raw path, a structured event format, and an API-key header to make malicious network activity appear like ordinary application telemetry.

This design could give an attacker advance knowledge of selected betting rounds and a way to confirm that the altered code remained active.

The package affected only systems exposing the intended FG-Crash method, meaning other users could unknowingly run the counterfeit dependency without visible harm.

Organizations should remove Newtonsoftt.Json.Net, replace it with the official Newtonsoft.Json 13.0.3 release or newer, and rebuild from a clean package restore.

They should also clear NuGet caches and internal mirrors, pin approved versions through lock files, restrict private feeds to approved packages, and examine historical connections to the listed command-and-control address.

Teams should treat near-identical package names as a serious warning sign, especially where applications process financial or game results.

Routine dependency review, version pinning, and outbound-traffic monitoring are practical safeguards against the same class of attack seen in the Braintree NuGet typosquatting case.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.