Affected Systems
NuGet package ecosystem; specifically developers who may mistype "Newtonsoft.Json" as "Newtonsoftt.Json.Net". Primary target appears to be applications using Digitain live gaming platform. Any .NET project that mistakenly installs the malicious package is affected.
Exploitation Status
Active supply chain attack. The malicious package has been published to the NuGet registry and is available for download. Exploitation occurs automatically upon package installation if developers mistype the legitimate package name.
Business Impact
Developers who install the typosquatted package will unknowingly deploy malicious code into production environments. The payload specifically targets Digitain gaming platforms to manipulate live game results, indicating potential financial fraud. Organizations using .NET and NuGet may face code integrity compromise, unauthorized system access, and reputational damage if malicious code reaches production. Supply chain risk extends to any downstream customers or users of affected applications.
Urgency
🟠Within 24 hours
Recommended Actions
- Audit all .NET projects and CI/CD pipelines for the malicious package 'Newtonsoftt.Json.Net' and remove immediately if found
- Implement NuGet package verification in build processes using package signature validation and lock files (packages.lock.json)
- Configure NuGet clients to only allow packages from trusted sources and enable package source mapping
- Review application logs and network traffic for connections to Digitain infrastructure or unexpected external communications
- Educate development teams on typosquatting risks and enforce code review for all dependency changes