NuGet Typosquat: How One Extra Letter Rigged a Betting Platform's Odds

A working JSON library that does everything Newtonsoft.Json does — except silently rig a betting platform’s odds ten minutes after it loads. That’s what JFrog Security Research found hiding behind one extra letter in a package name.

What Happened

The malicious package, Newtonsoftt.Json.Net, impersonated the real Newtonsoft.Json library that most .NET developers install without a second thought. The typosquat was built to survive scrutiny: it falsely credited the actual Newtonsoft.Json author, James Newton-King, linked to the legitimate project website, claimed the same MIT license, and used version numbers in the 11.0.x range that looked plausible next to the real library’s 13.x releases. Most damning for detection purposes, the package actually worked — it functioned as a genuine JSON serializer for anyone who installed it, which is precisely what let it hide in plain sight.

The payload targeted one specific victim: Digitain, a betting platform, and its FG-Crash game. JFrog found the trojan patched the GenerateGameResult method inside Digitain’s game logic, manipulating crash multipliers on a deterministic schedule known only to the attacker — enabling rigged rounds with predetermined outcomes.

Why It Matters

The delayed activation is the mechanism that made this attack durable. By waiting ten minutes after initialization, the payload avoided triggering during the application-startup checks most security tooling watches most closely. Later versions of the package went further, exfiltrating rigged results to attacker infrastructure while disguising the traffic as legitimate Seq logging telemetry — a second layer of camouflage on top of the first.

The package survived across seven published versions and three distinct malware generations between August and October 2025, undetected the entire time. It was only exposed when the package’s own metadata accidentally leaked a repository URL pointing to Digitain’s internal TFS server — an operational security mistake by the attacker, not a defense that worked as designed.

What This Means for Builders

This is a reminder that typosquat defenses built around “does the package do what it claims” miss attacks engineered to actually do what they claim, plus something extra. Package name verification has to happen at the character level — diffing against the exact string of a known-good dependency, not eyeballing a name that looks close enough. Teams pulling third-party packages into anything touching business logic, game outcomes, or financial calculations should treat delayed-activation behavior and outbound telemetry to unfamiliar hosts as detection signals worth building into CI, not assumptions to make about “obviously fine” open-source dependencies.

Source: JFrog

Content created with AI assistance and reviewed for accuracy.