Fake Newtonsoft.Json Package on NuGet Was Built to Rig Live Betting Games

Key points

• Researchers found a malicious package called Newtonsoftt.Json.Net on NuGet, the main software library store for Microsoft's .NET developers, posing as the well-known Newtonsoft.Json library.
• The package was a working fork of the real library with hidden code that targeted Digitain, a gambling technology firm, to interfere with live game outcomes.
• Seven versions of the fake package were uploaded before it was flagged.
• The attack aimed at rigging games rather than stealing passwords or data, which is unusual for this type of supply chain trick.

Security researchers have flagged a booby-trapped software package on NuGet designed to do something rarely seen in this space: cheat at live online gambling.

NuGet is the main marketplace where developers building software on Microsoft's .NET platform download small building blocks of code, called packages, to slot into their own programs. Think of it as an app store, but for the pieces developers use to assemble bigger apps.

The malicious package was named Newtonsoftt.Json.Net. Note the extra "t". It was impersonating Newtonsoft.Json, one of the most downloaded .NET libraries in the world, used by vast numbers of business applications to handle data.

This trick is called typosquatting: criminals register a name nearly identical to a trusted one, hoping a developer will mistype or copy the wrong version into their project. We covered a close relative of this attack on 29 May 2026, when a poisoned package impersonated Brazil's Sicoob banking network to steal the certificates that sign financial API calls.

Who was the target?

The target was Digitain, a company supplying betting and gaming software to online casinos and sportsbooks. According to The Hacker News, the tampered package contained hidden code aimed specifically at Digitain's systems, engineered to alter live game results as they played out.

That's a notable shift. Most poisoned packages on registries like NuGet or its rival npm are built to steal: passwords, crypto wallets, developer secrets. This one was built to cheat. If it landed inside a betting platform's codebase, it could quietly nudge outcomes toward whoever planted it.

How the fake package worked

The attackers didn't write junk code and slap a familiar name on it. They forked the real Newtonsoft.Json project, copying its genuine source code and bolting malicious logic on top.

That matters because a package that actually works is far less likely to raise flags. Programs keep running. Tests keep passing. The poison sits inside a library that looks entirely normal.

Seven versions of Newtonsoftt.Json.Net were published to NuGet before the package was caught. Each version is another opportunity for a developer to have pulled it into a live project by accident.

Should ordinary players be worried?

Probably not directly, and not right now. There's no public evidence the package reached Digitain's live platforms or that any player was cheated out of a specific bet.

The incident is still a warning about how supply chain attacks are evolving. A supply chain attack is when criminals skip the front door and instead poison one of the small ingredients many companies share, then wait for it to be pulled in automatically.

For players on any online betting site, the practical advice is simple. Use platforms licensed in your jurisdiction. Keep records of your bets. If a result looks wrong, dispute it through the operator and the regulator.

What developers should do

Anyone working with .NET projects should check their dependency lists for Newtonsoftt.Json.Net, with the double "t", and remove it immediately. The legitimate library is Newtonsoft.Json, published by James Newton-King.

Pinning exact versions, reviewing new dependencies before adding them, and using automated tools that flag suspicious packages all reduce the risk. So does slowing down. A single extra letter is all this attack needed.