Trojanized Newtonsoft.Json Clone Conceals Game-Cheating Code, Threatens .NET Applications
A malicious fork of the popular JSON library Newtonsoft.Json was found hiding game-rigging functionality, posing a supply chain risk for .NET developers and the websites they build.
A deceptive NuGet package impersonating a well-known fork of Newtonsoft.Json has been discovered containing hidden code designed to cheat in online games. The package, which appeared to function as a legitimate JSON serialization library, actually injected runtime hooks to manipulate game clients—yet it retained full JSON capabilities, making it harder to spot. This incident underscores the growing sophistication of software supply chain attacks aimed at compromising development environments and downstream applications.
Newtonsoft.Json is the most widely used JSON library in the .NET ecosystem, with hundreds of thousands of projects depending on it. The trojanized fork was distributed through a public package repository under a name similar to a legitimate community-maintained variant. Once installed, the library intercepted and altered game-related data streams while passing through all other JSON operations unchanged. For a business running .NET-based web services, such a compromise could lead to data interception, backend logic corruption, or even credential theft if the payload were repurposed.
The attack highlights how even a trusted open-source dependency can be weaponized when developers fail to verify package authenticity. The malicious code was embedded deep within the serialization logic, using conditional compilation to activate only in specific environments, evading static analysis. This technique is reminiscent of other recent supply chain incidents where popular libraries were poisoned to target cryptocurrency wallets or corporate networks. Website owners and IT teams must recognize that any third-party library—whether in the frontend or backend—can become a backdoor.
For .NET developers and operations teams, the immediate mitigation is to audit all NuGet dependencies, checking for typosquatting and verifying publisher signatures. Employing scrutiny tools that detect behavioral changes between package versions can also help. Moreover, adopting a minimal trust approach—such as using only official sources and locking dependencies to known-good hashes—significantly reduces the attack surface. In a managed hosting context, providers can add another layer by scanning for known malicious packages during deployment.
AEU-I’s security-first infrastructure and consulting services assist businesses in hardening their software supply chain—from dependency vetting to continuous monitoring—helping prevent trojanized libraries from slipping into production environments and safeguarding the applications that drive online commerce.