A malicious fork of the popular .NET serialization library Newtonsoft.Json has appeared on NuGet under the name NewJson.Net. The package delivers game-rigging malware while presenting itself as a fully functional version of the original library, making detection through normal use nearly impossible.
Newtonsoft.Json sits among the most downloaded packages in the .NET ecosystem with billions of installs, making it a natural target for supply chain attacks. The trojanized fork replicates the complete API surface, so developers who pull it in by mistake see expected behavior while the malware runs hidden in the background.
The malicious payload targets Unity-based PC games, modifying memory values to provide players with unfair advantages during gameplay. The malware can load additional modules from a remote server on demand, giving attackers the ability to update its functionality without pushing new packages to NuGet. This means the initial infection acts as a persistent foothold that can change behavior after installation.
Developers should verify NuGet publisher identity against the original Newtonsoft.Json publisher before accepting any package with a similar name. The attack follows an established pattern: supply chain infections that hide inside working library forks are becoming harder to catch through standard functionality testing alone.
