🟠 High | Source: The Hacker News
A malicious NuGet package named ‘Newtonsoftt.Json.Net’ has been discovered masquerading as the widely-used Newtonsoft.Json library through typosquatting. Unlike typical supply chain attacks targeting credential theft, this trojanised fork embeds code designed to manipulate live game results on the Digitain sports betting platform. Seven versions of the package were published, making it a persistent and targeted threat.
Security Architect’s Take: Audit your organisation’s NuGet package references immediately for typosquatted dependencies, paying particular attention to high-usage libraries like Newtonsoft.Json. Enforce private package feeds with allowlisting policies and integrate software composition analysis (SCA) tooling into your CI/CD pipelines to flag unverified or suspicious package names before build.
Original advisory: Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library