A Single Extra “t” in a NuGet Package Allow Attackers to Manipulate Results

A malicious NuGet package used a single extra letter to hide in plain sight, turning a familiar software dependency into a betting-fraud tool.

The package, Newtonsoftt.Json.Net, copied the appearance of the widely used Newtonsoft.Json library while carrying code designed to alter game outcomes.

The campaign relied on typosquatting, a tactic that exploits small spelling mistakes made during package installation.

Developers who selected the counterfeit package received a working JSON library, allowing the threat to remain hidden while affected applications continued operating as expected.

Researchers at JFrog identified the package and found that it specifically targeted Digitain’s FG-Crash betting-game backend.

JFrog said in a report shared with Cyber Security News (CSN) that the package was built for precision fraud rather than broad credential theft or destructive activity.

The malicious package was available on NuGet from August through October 2025 and was later unlisted, although its artifacts remained downloadable at the time of the research.

The incident reinforces why developers should verify package names and origins, particularly after recent malicious NuGet packages targeting developers showed how trusted dependency ecosystems can be abused.

Typosquat Package Alters Game Results

The name Newtonsoftt.Json.Net differs from the genuine library by only one additional “t” and a misleading .Net suffix.

Its metadata imitated the genuine project by listing James Newton-King as author, using a familiar project URL, and presenting a believable 11.0.x versioning pattern.

Inside the package were a trojanized JSON assembly, a payload DLL named Newtonsoft.Values.Net.dll, and the legitimate HarmonyLib runtime-patching component.

Since NuGet automatically references assemblies stored under the package’s libnet8.0 directory, an application could load the malicious payload without a developer deliberately calling it.

The code waited until an application configured JsonConvert.DefaultSettings, then replaced the application’s chosen JSON resolver with its own.

It scheduled its patch after a delay, reducing the chance that developers would see suspicious behavior during startup, much like techniques described in a malicious NuGet logging package investigation.

Once active, the payload used Harmony to modify GenerateGameResult, a method connected to Digitain’s Crash-style game.

Earlier versions changed compiled instructions, while later variants directly replaced the returned result with attacker-selected values based on time, date, and preset tables.

The threat actor released seven versions across three generations, gradually changing obfuscation, result-rigging methods, and data-exfiltration capabilities.

This evolution shows how a targeted supply-chain intrusion can be refined over time, echoing the wider risks seen in open source package attacks.

Delayed Fraud and Data Theft

The newest identified version, 11.0.11, sent manipulated results to an attacker-controlled server using a request shaped to resemble Seq logging traffic.

It used the /api/events/raw path, a structured event format, and an API-key header to make malicious network activity appear like ordinary application telemetry.

This design could give an attacker advance knowledge of selected betting rounds and a way to confirm that the altered code remained active.

The package affected only systems exposing the intended FG-Crash method, meaning other users could unknowingly run the counterfeit dependency without visible harm.

Organizations should remove Newtonsoftt.Json.Net, replace it with the official Newtonsoft.Json 13.0.3 release or newer, and rebuild from a clean package restore.

They should also clear NuGet caches and internal mirrors, pin approved versions through lock files, restrict private feeds to approved packages, and examine historical connections to the listed command-and-control address.

Teams should treat near-identical package names as a serious warning sign, especially where applications process financial or game results.

Routine dependency review, version pinning, and outbound-traffic monitoring are practical safeguards against the same class of attack seen in the Braintree NuGet typosquatting case.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Malicious package	Newtonsoftt.Json.Net	Typosquatted NuGet package identified as XRAY-1019668
Package versions	11.0.4, 11.0.5, 11.0.7, 11.0.8, 11.0.9, 11.0.10, 11.0.11	Observed malicious package versions
C2 URL	hxxp://185.126.237.64:5341/api/events/raw	Endpoint used to receive rigged game results
IP address	185.126.237.64	Command-and-control server address
HTTP header	X-Seq-ApiKey: theperfectheist2025	Header and key used in C2 communications
Harmony identifier	com.example.harmony	Harmony instance identifier used by the payload
Patched method	Digitain.FG.SharedCrash.GameLogic.SharedCrashRules.GenerateGameResult	Targeted game-result generation method
File name	Newtonsoft.Json.net.dll	Trojanized Newtonsoft.Json fork
File name	Newtonsoft.Values.Net.dll	Malicious payload assembly
File name	0Harmony.dll	Bundled HarmonyLib runtime-patching assembly
SHA-256	3fbe32d76a22bda7a8fd3cdc6faf68807108f01d74ec8b346f4c5d4b61dbc84b	Newtonsoft.Values.Net.dll, version 11.0.4
SHA-256	fe498d584f43b7d6ebe2ebc34481d9b0e8e931d2af039f59451bf42effe8b461	Newtonsoft.Values.Net.dll, version 11.0.5
SHA-256	5d062e3e52d36d3e66f1c4b54e26149a5b552417f8cc360c390b568aaeb92678	Newtonsoft.Values.Net.dll, version 11.0.7
SHA-256	ba8f36968c8cdd9799c1d5e5619d1a5d6a0b1eabfd7876daa3cfdebd51dd4516	Newtonsoft.Values.Net.dll, version 11.0.8
SHA-256	c162009eda7579c3bf5f4fb1606368270c989433d8923d43e033bd5aefc8e335	Newtonsoft.Values.Net.dll, version 11.0.9
SHA-256	c386d416afef8319bf11c9180f6d35c0e1f7cb40b7a0c81b166c253afc623706	Newtonsoft.Values.Net.dll, version 11.0.10
SHA-256	4ed6e7b56abece2bef9cdddd0d10da2f8379a09ff94541ed0e70152f669c6682	Newtonsoft.Values.Net.dll, version 11.0.11

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

ALERT!: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.