Cybersecurity researchers have discovered a NuGet package that represents a significant evolution in software supply chain attacks: a fully functional trojanized library designed to manipulate live operations while also harvesting data.
The package, named "Newtonsoftt.Json.Net," masquerades as the popular Newtonsoft.Json library in a classic typosquatting scheme. However, analysis detailed by The Hacker News reveals it as a "trojanized fork." Unlike many malicious packages that are broken or obviously harmful, this one executes normally, passing basic static analysis and evading signature-based security scans. Seven versions were published to the registry.
The payload's design marks a shift in attacker objectives. The malicious code intercepts data within applications targeting the Digitain gaming platform. Its primary function is to manipulate game data in real-time to rig outcomes, turning a development dependency into a tool for operational subversion and financial fraud. Critically, later versions of the package also exfiltrate this manipulated game results data disguised as telemetry, blending live tampering with covert data theft.
This dual-purpose attack underscores a critical evolution in the threat model. While data exfiltration remains a component, the emphasis has moved toward compromising system functionality and integrity. For developers in sectors like finance, gaming, and industrial control, the risk now encompasses not just data loss, but the generation of fraudulent operational outcomes.
The "working library" evasion tactic highlights a critical gap in many conventional security tools, which are optimized to scan for known vulnerabilities or broken code rather than analyze behavioral anomalies in legitimate-looking dependencies. It underscores the need for deeper scrutiny, including verification of package provenance and continuous behavioral monitoring after installation.
At the time of reporting, it was unclear what specific remediation guidance Digitain has provided to its developers. This incident serves as a stark reminder that modern supply chain security requires a focus on both the provenance and the ongoing behavior of libraries, moving beyond one-time vulnerability scans to protect against evolving, functional threats.
網絡安全研究人員發現一個 NuGet 軟件包，代表着軟件供應鏈攻擊的重大演進：一個功能完整、經木馬化處理的函數庫，旨在操控即時運作同時收割數據。
該軟件包名為「Newtonsoftt.Json.Net」，透過經典的拼寫錯誤仿冒方案，冒充流行的 Newtonsoft.Json 函數庫。然而，據 The Hacker News 的詳細分析揭露，這實為一個「木馬化分支」。與許多損壞或明顯有害的惡意軟件包不同，此軟件包能正常運作，通過基本靜態分析，並規避基於簽名的安全掃描。共有七個版本發布至套件庫。
載荷的設計標誌著攻擊者目標的轉變。惡意代碼旨在攔截針對 Digitain 遊戲平台應用程式中的數據。其主要功能是即時操縱遊戲數據以操控結果，將一個開發依賴項轉變為用於營運顛覆和金融欺詐的工具。關鍵的是，該軟件包的後續版本還會將被篡改的遊戲結果數據偽裝成遙測數據外洩，結合即時篡改與隱蔽數據竊取。
這種雙重用途的攻擊突顯了威脅模型的關鍵演進。雖然數據外洩仍是一個組成部分，但重點已轉向損害系統功能與完整性。對金融、遊戲及工業控制等行業的開發者而言，風險現在不僅限於數據損失，還包括產生欺詐性營運結果。
這種「運作中函數庫」的規避策略，凸顯了許多傳統安全工具的關鍵盲點。這些工具通常優化用於掃描已知漏洞或損壞代碼，而非分析看似合法的依賴項中的行為異常。這突顯了更深入審查的必要性，包括核實軟件包來源及安裝後持續的行為監控。
在報導時尚不清楚 Digitain 向其開發者提供了哪些具體補救指引。此事件作為一個明確提醒：現代供應鏈安全需要同時關注函數庫的來源及其持續行為，必須超越一次性漏洞掃描，以防禦不斷演進的功能性威脅。