Live betting manipulation: the typosquat of NuGet who impersonated Newtonsoft.Json

A recent finding in the ecosystem .NET puts on the table a less obvious but more targeted variant of the supply chain attacks: a typosquat package published in NuGet that passes through the popular Newtonsoft.Json library, but which actually contains a Trojan designed to manipulate the live results of an online gambling game operated by Digitain. This case breaks the typical pattern of malicious packages that seek to steal credentials or information: its main objective is the integrity of service, not the mass exfiltration of data from other developers.

The trap was hidden in a package with a name very similar to the legitimate and seven versions published between August and October 2025. Technically the entry door is subtle: the trojanized code is activated when the application assigns JsonConvert.DefaultSettings, a legitimate behavior extension of Newtonsoft.Json. Only in systems that expose the specific API of the target game backend is manipulation initiated, and the author added random delays and opfuscation in different generations of the payload to evade analysis and detection.

There are two points that aggravate the gravity of the incident. The first is focus: the package acts normally for most consumers, which reduces the likelihood that developers or security equipment will detect something out of the ordinary. The second is the presence of metadata from the package that reveal an internal URL of the Digitain repository, which suggests access to the target service source code or filtration of sensitive information, and makes this a possible commitment to the intellectual property of the game provider.

From the attacker's perspective, the campaign showed evolution: a first generation that only showed how to alter local results, a second that added hidden exfiltration through reflection and ConfuserEx, and a third that stabilized that mechanism. The exfiltration endpoint documented in the analysis is a specific IP address and a port and the payload uses a specific header to transmit data, which facilitates detection if the right traffic is monitored.

The operational and regulatory implications are important. For Digitain and any gambling operator, the integrity of the bets is critical: manipulating results compromises confidence, carries legal risks and can trigger audits and sanctions. For the developer community, this case recalls that public repositories can be used for selective attacks and that an innocent installation by typographic error can have consequences on third parties.

The immediate actions recommended for developers are clear: remove any suspicious package, block the detected exfiltration endpoint at the network level, and set (pin) the Newtonsoft.Json version known and verified by packages.lock.json or equivalent mechanisms to avoid automatic updates to unverified packages. It is also appropriate to scan the code in search of assignments to JsonConvert.DefaultSettings and to review transitional units that may have dragged the typosquat.

At the process level, it is essential to strengthen the control of the supply chain: to maintain an internal Mirror or a NuGet controlled feed with approved packages, to enable the verification of package signatures when available, to generate and audit SBOMs of critical projects, and to apply allowlist rules in CI / CD systems to prevent facilities from public repositories without revision. It is also a priority to review logs and telemetry in search of outgoing connections to the above IP and the use of the exfiltration header to identify commitments.

For organizations that may have been affected it is appropriate to activate a response plan: to preserve evidence, to review binary integrity, to audit internal repositories for signs of code leakage and, if results are confirmed, to coordinate with the supplier concerned to assess the scope and to notify regulators and customers as appropriate. If required, bring external forensic expertise to rebuild the chronology and determine whether there was access to secrets or credentials.

At the preventive level, technical officials should actively monitor packages published under names similar to critical libraries and set up alerts for changes in dependencies. Supply chain analysis tools and scanning of public repositories, along with practices such as the revision of dependencies before promotion to productive environments, reduce the exposure window to typosquats and targeted Trojans.

This incident again shows that the security of the supply chain is not only a matter of confidentiality but of integrity and availability: a malicious package can be perfectly functional for most users while sabotaging very specific systems. To understand better risks and practical measures, teams can consult public resources and analysis on threats to repositories such as those published by security companies and the code platforms themselves (e.g. technical documentation and publications on specialized blogs). A good starting point to audit dependencies and stay informed is to review the official repository of Newtonsoft.Json in GitHub https: / / github.com / JamesNK / Newtonsoft.Json and general recommendations on supply chain security on JFrog's blog https: / / jfrog.com / blog /. In addition, to review packages and search for possible typosquats, the official NuGet website is available on https: / / www.nuget.org /.