Fake Newtonsoft.Json Package on NuGet Was Built to Rig Live Betting Games

Key points

• Researchers found a malicious package called Newtonsoftt.Json.Net on NuGet, the main software library store for Microsoft's .NET developers, posing as the well known Newtonsoft.Json library.
• The package was a working fork of the real library with hidden code that targeted Digitain, a gambling technology firm, to interfere with live game outcomes.
• Seven versions of the fake package were uploaded before it was flagged.
• The attack aimed at rigging games rather than stealing passwords or data, which is unusual for this type of supply chain trick.

Security researchers have flagged a booby-trapped software package on NuGet that was designed to do something researchers rarely see: cheat at live online gambling.

NuGet is the main marketplace where developers who build software using Microsoft's .NET platform download small building blocks of code, called packages, to slot into their own programs. Think of it as an app store, but for the pieces developers use to assemble bigger apps.

The malicious package was named Newtonsoftt.Json.Net. Note the extra "t". It was pretending to be Newtonsoft.Json, one of the most downloaded .NET libraries in the world, used by huge numbers of business applications to handle data.

This trick has a name. It is called typosquatting, where criminals register a name that looks almost identical to a trusted one, hoping a developer will mistype or copy the wrong version into their project.

Who was the target?

The target was Digitain, a company that supplies betting and gaming software to online casinos and sportsbooks. According to reporting from The Hacker News, the tampered package contained hidden code aimed specifically at Digitain's systems, engineered to alter the results of live games as they played out.

That is a notable shift. Most poisoned packages on registries like NuGet or its rival npm are built to steal: passwords, crypto wallets, developer secrets, source code. This one was built to cheat.

If it landed inside a betting platform's software, the hidden code could quietly nudge outcomes in a direction that favoured whoever planted it. The house, in effect, would no longer be the only one with an edge.

How the fake package worked

The attackers did not write junk code and slap a familiar name on it. They forked the real Newtonsoft.Json project, meaning they copied its genuine source code, and then bolted their own malicious logic on top.

That matters. A package that actually works, and does what developers expect, is far less likely to be noticed. Programs keep running. Tests keep passing. The poison sits quietly inside a library that appears entirely normal.

Seven versions of Newtonsoftt.Json.Net were published to NuGet before the package was caught. Each version is another chance for a developer, somewhere, to have pulled it into a project by accident.

Should ordinary players be worried?

Probably not directly, and not right now. There is no public evidence that the package reached Digitain's live platforms or that any player was cheated out of a specific bet.

But the incident is a warning about how supply chain attacks are evolving. A supply chain attack is when criminals do not break into a company head on. Instead, they poison one of the small ingredients that many companies use, and wait for it to be pulled in.

For players on any online betting site, the practical advice is unchanged. Use platforms that are licensed in your country. Keep records of your bets. If a result looks wrong, dispute it through the operator and the regulator.

What developers should do

Anyone who works with .NET projects should check their package lists for Newtonsoftt.Json.Net, with the double "t", and remove it. The legitimate library is Newtonsoft.Json, published by James Newton-King.

Pinning exact versions, reviewing new dependencies before adding them, and using automated tools that flag suspicious packages all help. So does slowing down. A one letter typo is all this attack needed.