A trojanized NuGet package reportedly masqueraded as Newtonsoft.Json, stayed useful for ordinary .NET apps, and only turned hostile inside a betting backend where integrity mattered most.