Newtonsoft.Json.Net: a trojanized fork of the .NET library to rig sports betting

A NuGet package mimics the famous Newtonsoft.Json by one "t" and hides, in a library that actually works, code intended to rig live betting results on Digitain.

Facts

According to The Hacker News (July 22, 2026), researchers discovered a typosquat on NuGet named « Newtonsoftt.Json.Net » - two "t"s - that impersonates the famous Newtonsoft.Json library. Seven versions were published on the registry. This is not a classic info-stealer: it's a trojanized fork that specifically targets live sports betting on Digitain.

Analysis

Two points stand out.

The NuGet typosquat remains an open surface. The difference of one character between Newtonsoft.Json (the real one, ~4 billion historical downloads according to nuget.org) and Newtonsoftt.Json.Net is enough to trap any unfortunate copy-paste in a CSPROJ, a CI build script, or a StackOverflow doc - not to mention LLMs that regularly hallucinate similar package names.

The payload is atypical. The attacker does not sell credit cards nor does he deploy a general-purpose RAT. He targets a specific platform (Digitain, an iGaming software provider used by many bookmakers) and a specific class of fraud (rigging live results). This is finalized supply chain: the developer who integrates the library is a vector towards a specific production environment, not a target in itself.

What to do

To do now:

• Audit your NuGet dependencies for Newtonsoftt.Json.Net (grep on .csproj files, packages.lock.json, CI artifacts).
• If present: remove, recompile, run an antimalware scan on build hosts and servers that have executed the binary.
• Pin the real Newtonsoft.Json (Author: James Newton-King, exact ID) in a restrictive NuGet.config with packageSourceMapping.
• Enable package signature verification and, if possible, restrict NuGet sources to a validated internal mirror.

To remember

Supply-chain typosquatting is no longer just about "stealing npm tokens." A package can be a targeted tool against a sector (here iGaming) - vigilance over dependency names has become basic hygiene, not a luxury.