This NuGet Package Looked Legit, But It Was Rigging Sports Bets

Michael Miller · 2026-07-22

You know how some software packages just feel trustworthy? They've got a solid reputation, hundreds of thousands of downloads, and a name you recognize. That's exactly what the attackers behind a new threat were banking on. Cybersecurity researchers recently uncovered a NuGet typosquat that's nothing like the usual info-stealing malware you see floating around package registries. Instead of grabbing passwords or credit card numbers, this one was built to rig live game results on Digitain, a popular online sports betting platform. The package in question is called "Newtonsoftt.Json.Net." Notice the extra 't'? It's a trojanized fork of the real Newtonsoft.Json library, which is one of the most widely used JSON frameworks for .NET developers. The bad actors published seven versions of this malicious package to NuGet, hoping developers would accidentally install it instead of the genuine one. And because the code actually works as a functional JSON library, it doesn't raise immediate red flags. ### How the Attack Works Here's the scary part: the malware doesn't just sit there quietly. Once installed, it quietly hooks into the Digitain API calls happening in the background. When a user places a bet on a live game, the malware intercepts that request and tweaks the outcome data before it reaches the server. Think of it like someone slipping a card up their sleeve in a poker game, except here, they're rewriting the deck itself. The code is carefully designed to blend in. It uses the same namespaces and methods as the real Newtonsoft.Json library, so even a quick glance at the source code won't reveal anything suspicious. The malicious logic is buried deep inside the JSON parsing functions, making it incredibly hard to spot during regular code reviews. ### Why This Matters for Developers If you're a developer working with .NET, this should hit close to home. We often rely on open-source packages to speed up development, but we don't always double-check every dependency. A single typo in your package manager console can lead to a compromised application. And in this case, the stakes are high, we're talking about rigged gambling outcomes and potential legal fallout. - Always verify the package name before installing. Look for extra letters, misspellings, or unusual capitalization. - Use package lock files to pin specific versions. This prevents accidental updates to malicious forks. - Regularly audit your dependencies with tools like Dependabot or Snyk. - Check the package's download history and maintainer reputation on NuGet. ### The Broader Picture This isn't just about one bad package. It's a sign that supply chain attacks are getting more sophisticated. Instead of stealing data, attackers are now manipulating the very logic of applications. They're targeting industries where a small change can have a big financial impact, like online gambling, stock trading, or auction platforms. The Digitain case is a wake-up call. If a sports betting platform can be rigged through a seemingly harmless JSON library, what else is vulnerable? The same technique could be used to alter stock prices, manipulate auction bids, or skew survey results. The only limit is the attacker's imagination. ### What You Can Do Right Now First, check your project's dependencies. If you've ever installed "Newtonsoftt.Json.Net" by mistake, remove it immediately and replace it with the genuine "Newtonsoft.Json." Run a full security scan on your codebase to make sure no traces of the malicious package remain. Second, educate your team. Share this story with your fellow developers. A simple conversation about typosquatting could prevent a costly incident down the road. Third, consider implementing a package approval process. Before any new dependency is added to your project, have someone review it. This extra step might slow things down a bit, but it's worth it when you're dealing with something as critical as live betting outcomes. ### Final Thoughts It's easy to get complacent when you're using the same tools day in and day out. But this attack shows that even the most trusted libraries can be weaponized. Stay sharp, double-check your packages, and never assume a name alone makes something safe. The good news? Researchers caught this one before it caused widespread damage. But there's no doubt more are out there, waiting for someone to slip up. Don't let that someone be you.