NuGet Package Allows Attackers

Overview

A subtle typo turned into a supply‑chain attack vector. Security researchers at JFrog uncovered a malicious NuGet package named Newtonsoftt.Json.Net — a typosquatted version of the legitimate Newtonsoft.Json library. This counterfeit dependency infiltrated developer environments and manipulated betting‑game outcomes, showing how one extra letter can compromise entire ecosystems.

Attack Mechanics

• The malicious package mirrored the metadata of the genuine library (author, project URL, versioning).
• It embedded a trojanized JSON assembly and a payload DLL named Newtonsoft.Values.Net.dll.
• Once installed, the malware replaced the legitimate JSON resolver, delaying activation to avoid detection.
• Using HarmonyLib, attackers patched the GenerateGameResult method, altering betting outcomes based on preset tables and timestamps.
• Over seven versions, the attacker refined obfuscation and manipulation techniques, evolving from simple instruction changes to full‑scale data tampering.

Fraud and Data Exfiltration

• The latest malicious release (11.0.11) transmitted manipulated results to an attacker‑controlled server disguised as Seq logging traffic.
• Requests to /api/events/raw carried fake telemetry with the header: X‑Seq‑ApiKey: theperfectheist2025.
• This made malicious traffic appear legitimate.
• Only systems exposing the targeted FG‑Crash backend method were directly affected, but other environments unknowingly hosted the counterfeit dependency.

Indicators of Compromise (IoCs)

Type	Indicator	Description
Malicious package	Newtonsoftt.Json.Net	Typosquatted NuGet package (XRAY‑1019668)
Versions	11.0.4 – 11.0.11	Observed malicious releases
C2 URL	hxxp://185.126.237.64:5341/api/events/raw	Endpoint for rigged results
IP address	185.126.237.64	Command‑and‑control server
Header	X‑Seq‑ApiKey: theperfectheist2025	Used in C2 communications
Patched method	Digitain.FG.SharedCrash.GameLogic.SharedCrashRules.GenerateGameResult	Targeted game‑result logic
File names	Newtonsoft.Values.Net.dll, 0Harmony.dll	Malicious payload assemblies

Mitigation Steps

Organizations should:

• Remove Newtonsoftt.Json.Net and reinstall the official Newtonsoft.Json 13.0.3 or newer.
• Clear NuGet caches and rebuild from clean sources.
• Pin approved versions using lock files.
• Restrict private feeds to verified packages only.
• Monitor outbound traffic for connections to the listed C2 address.

Expert in the Cloud Insight

This incident underscores the power of typosquatting in supply‑chain attacks. Developers often trust repositories like NuGet, but attackers exploit that trust with near‑identical names. The lesson is clear: dependency audits, strict version pinning, and vigilant traffic monitoring are essential defenses. One extra letter can mean the difference between trusted code and a precision‑fraud weapon.