NuGet trap: Newtonsoft.Json.Net rigs sports results in production

A trojanized fork of Newtonsoft.Json was published on NuGet under the name "Newtonsoftt.Json.Net"—one letter different. Seven versions of the package circulated with code designed to tamper with live results from the Digitain sports betting platform.

What's happening

Cybersecurity researchers have uncovered an unusually creative supply chain campaign targeting NuGet (the .NET package manager): instead of deploying a classic infostealer, the malicious package is designed to rig live sports results on the Digitain platform.

The package is named "Newtonsoftt.Json.Net"—with two ts in Newtonsoft. It’s a typosquat of the famous Newtonsoft.Json (Json.NET), one of the most downloaded .NET libraries in the world. Seven versions were published on the NuGet registry.

Why this is interesting (and worrying)

The target isn’t an individual user: it’s Digitain’s backend infrastructure, a B2B sports betting platform that powers gaming operators worldwide. If Digitain or one of its partners integrates the fake package, the malicious code could manipulate odds, scores, or real-time match results.

This is a sophisticated financial attack vector: no need to hack betting servers directly—just slip malicious code into a .NET dependency.

The package masquerades as a functional fork of Newtonsoft.Json—it does everything the real library is supposed to do, with added manipulation code. This type of attack is particularly insidious because unit tests and integration tests usually pass.

Who is affected

• .NET developers who typed Newtonsoftt.Json.Net instead of Newtonsoft.Json
• Teams using unverified lock-files or importing packages without auditing
• Digitain operators via potentially compromised dependencies from a partner

What to do

1. Audit your packages.lock.json and *.csproj files to check for "Newtonsoftt.Json.Net" (double-t)
2. Use a supply chain verification tool: dotnet list package -include-transitive to list all dependencies
3. Pin critical dependency versions and verify their hashes during restore
4. Enable NuGet Package Signing if your organization has disabled it

Do this now: grep -r "Newtonsoftt" *.csproj packages.lock.json across all your .NET repositories. One false positive worth checking beats a silent compromise.