Trojanized Newtonsoft.Json Fork Targets Gaming Platform
A malicious NuGet package disguised as a popular JSON library was found rigging game outcomes. This supply chain attack highlights risks in third-party dependencies.
TL;DR
- Threat actors published a trojanized version of Newtonsoft.Json on NuGet.
- The fake package, 'Newtonsoftt.Json.Net', rigs live game results on Digitain.
- Seven versions were uploaded, mimicking a legitimate and widely-used library.
- Unlike typical info-stealers, this malware focuses on manipulating gaming outcomes.
- Organizations should verify package signatures and monitor for typosquatted libraries.
Cybersecurity researchers have uncovered a novel form of supply chain attack involving a trojanized fork of the widely used Newtonsoft.Json library. Distributed through the NuGet package manager, the malicious package—named "Newtonsoftt.Json.Net"—is designed not to steal data but to manipulate live game results on the Digitain gaming platform.
This discovery marks a departure from the common malware tactics seen in package repositories, which typically focus on credential theft or system reconnaissance. Instead, the attackers aimed to influence real-time gaming outcomes, suggesting a targeted approach likely motivated by financial gain or fraud.
Attack Details
- The package name 'Newtonsoftt.Json.Net' closely resembles the legitimate 'Newtonsoft.Json'.
- Seven different versions of the malicious package were published to NuGet.
- It functions as a working library to avoid suspicion while executing hidden payloads.
- Payloads are specifically engineered to interfere with Digitain's live game mechanics.
- No evidence yet suggests widespread compromise beyond targeted gaming environments.
Security Implications
- Typosquatting remains a critical risk in public package repositories like NuGet.
- Organizations using third-party libraries should enforce strict dependency verification.
- Monitoring tools should flag unexpected or slightly altered package names during builds.
- Supply chain attacks can now extend beyond data theft to operational manipulation.
- Developers should prioritize signed packages and use allowlists for trusted sources.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.