A trojanized Newtonsoft.Json fork on NuGet smuggles game-rigging malware inside a fully functional serialization library to evade detection.
A fraudulent Sicoob.Sdk NuGet package steals client IDs and PFX certificates, potentially allowing attackers to impersonate Brazilian banking API integrations.