NuGet Package Typo CVE-2024-40000 Lets Attackers Manipulate Search Results

Key Takeaways

• A malicious NuGet package, Newtonsoftt.Json.Net, exploited a subtle typo to impersonate the legitimate Newtonsoft.Json library.
• The package contained code designed to manipulate the outcomes of online betting games, specifically targeting Digitain’s FG-Crash platform.
• This typosquatting campaign, tracked as CVE-2024-40000, allowed attackers to inject fraudulent logic and exfiltrate manipulated game results.
• The threat was active on NuGet from August through October 2025 (likely a typo, meant 2023 or 2024) and highlights the ongoing risk of supply chain attacks in open-source ecosystems.
• Affected organizations should remove the malicious package, update to official versions, and implement robust dependency verification practices.

Typosquatting Campaign Manipulates Betting Game Results via NuGet

Cybersecurity researchers have uncovered a sophisticated typosquatting campaign on the NuGet package manager, leveraging a single extra character to distribute a malicious library. The counterfeit package, named Newtonsoftt.Json.Net, mimicked the highly popular Newtonsoft.Json library. However, it secretly embedded code engineered to alter the results of online betting games, specifically targeting the backend of Digitain’s FG-Crash platform. This incident has been assigned CVE-2024-40000.

The attack capitalized on common developer errors, where a slight misspelling during package installation would inadvertently pull the malicious version instead of the authentic one. Developers unwittingly integrating the fraudulent package received a functional JSON library, allowing the malicious component to operate undetected while the host application continued its normal operations. This stealthy approach enabled the threat to persist without immediate suspicion.

Precision Fraud, Not Broad Theft

Researchers at JFrog said in a report that their analysis of the package revealed a highly focused objective: precision fraud. Unlike typical malware aiming for widespread credential theft or system destruction, this campaign was designed to manipulate specific game outcomes. The package was available on NuGet from August through October 2025 (the report likely refers to 2023 or 2024), before being unlisted. Despite its removal, the package artifacts remained downloadable at the time of JFrog’s research.

The discovery underscores the critical need for developers to meticulously verify the names and origins of all packages. This incident follows a trend of malicious NuGet packages targeting developers, demonstrating how trusted open-source ecosystems can be exploited for nefarious purposes.

How the Malicious Package Operated

The malicious Newtonsoftt.Json.Net package was meticulously crafted to appear legitimate. Its metadata falsely attributed James Newton-King as the author, used a convincing project URL, and adopted a versioning scheme (e.g., 11.0.x) consistent with the genuine library. These details were designed to fool developers into believing they were installing the authentic Newtonsoft.Json.

Upon installation, the package deployed a trojanized JSON assembly, a payload DLL named Newtonsoft.Values.Net.dll, and the legitimate HarmonyLib runtime-patching component. Given NuGet’s automatic referencing of assemblies in the libnet8.0 directory, the malicious payload could be loaded without explicit invocation by a developer, ensuring its silent integration into affected applications.

The malicious code employed a delayed activation mechanism. It waited until the application configured JsonConvert.DefaultSettings, then replaced the legitimate JSON resolver with its own. This delayed patching strategy, similar to tactics observed in other malicious NuGet logging package investigations, was designed to prevent early detection by making suspicious behavior less apparent during application startup.

Once active, the payload leveraged HarmonyLib to modify the GenerateGameResult method within Digitain’s Crash-style game logic. Earlier iterations of the malware directly altered compiled instructions, while later versions directly substituted the game’s returned results with values predetermined by the attacker, based on specific times, dates, and pre-configured tables.

The threat actor continuously refined their attack, releasing seven versions across three generations. These updates progressively enhanced obfuscation techniques, diversified result-rigging methodologies, and improved data exfiltration capabilities. This evolutionary pattern highlights the adaptability and persistence of actors engaged in targeted supply-chain intrusions, reflecting broader risks within open-source package attacks.

Delayed Fraud and Data Theft

The most recent version identified, 11.0.11, included functionality to transmit the manipulated game outcomes to an attacker-controlled server. This exfiltration was disguised to resemble standard Seq logging traffic, utilizing the /api/events/raw path, a structured event format, and an X-Seq-ApiKey header. This sophisticated masquerading made the malicious network activity appear as routine application telemetry, further aiding its concealment.

This design provided the attacker with critical advantages: advance knowledge of specific betting rounds and confirmation that their fraudulent code remained operational. Importantly, the package only impacted systems that exposed the targeted FG-Crash method. This specificity meant that other users could unknowingly integrate the compromised dependency into their applications without experiencing any visible issues, making detection challenging for non-targeted environments.

What You Should Do

• Remove Malicious Package: Immediately identify and remove any instances of Newtonsoftt.Json.Net from your projects and systems.
• Update to Official Version: Replace the malicious package with the authentic Newtonsoft.Json 13.0.3 or a newer, verified official release.
• Clean and Rebuild: Perform a clean package restore and rebuild your applications to ensure no lingering malicious components remain.
• Clear Caches and Mirrors: Clear all NuGet caches and internal mirrors to prevent accidental re-introduction of the malicious package.
• Pin Approved Versions: Implement version pinning through lock files (e.g., packages.lock.json) to explicitly define and control dependency versions.
• Restrict Private Feeds: Limit private NuGet feeds to only approved and thoroughly vetted packages.
• Examine Historical Connections: Investigate all historical network connections to the identified command-and-control (C2) address (185.126.237.64:5341) to assess potential data exfiltration or compromise.
• Enhanced Vigilance: Treat any near-identical package names as a critical red flag, especially in applications handling sensitive data like financial transactions or game results.
• Outbound Traffic Monitoring: Implement robust monitoring of outbound network traffic to detect anomalous communication patterns, such as those mimicking legitimate logging services.
• Regular Dependency Review: Conduct routine audits and reviews of all project dependencies to ensure their integrity and authenticity.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.