Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library

Cybersecurity researchers have discovered a NuGet typosquat that's unlike the typical information-stealing malware distributed via package registries: usual info-stealers: it's designed to rig live game results on Digitain. The package, named "Newtonsoftt.Json.Net," masquerades as the Newtonsoft.Json library and is a trojanized fork. Seven versions of the package have been published to the

The article reports that a trojanized NuGet package, "Newtonsoftt.Json.Net", is a malicious fork of the widely used Newtonsoft.Json library, published in seven versions and designed to rig live game results on the Digitain betting platform, with later variants exfiltrating manipulated round data to an attacker-controlled server.[1] Researchers note it behaves as a fully functional JSON library while secretly performing game-rigging and data exfiltration using a custom header, making it harder for developers to detect during normal use.[1] From a RealGround perspective, this is an AI supply chain risk pattern directly applicable to any AI or agent-based system that relies on third-party libraries: a trusted dependency can be silently replaced by a typosquatted, weaponized fork that still passes functional tests but embeds abusive business logic. Organizations building or operating AI agents should respond by implementing rigorous SBOM-driven dependency inventory, continuous scanning for typosquats and malicious forks in package ecosystems, and hard pinning to vetted versions, combined with periodic AI security readiness assessments to ensure agent workflows cannot be subverted v