Trojanized Newtonsoft.Json Fork Rigs Online Game Results

Researchers at JFrog have discovered an unusual malicious package in the NuGet repository. Unlike the typical infostealers that usually clutter these registries, it doesn't steal data — it rigs the results of a live online game on the Digitain betting platform.

The package is called Newtonsoftt.Json.Net — with an extra letter, banking on a typo by developers looking for the popular Newtonsoft.Json library. It is essentially a trojanized fork of it (based on version 13.0). Seven versions were published to NuGet — from 11.0.4 to 11.0.11 — and together they were downloaded around 1,200 times. The owner, who went by the handle MagicalPuff96, has unlisted the package: it no longer shows up in search, but the artifacts are still available for download.

Works as intended — until it doesn't

The most curious thing about this attack is how narrowly targeted it is. A developer who accidentally installs the package via a typo gets a genuine, fully working build of Newtonsoft.Json. The malicious logic hides in a modified setter for the JsonConvert.DefaultSettings property: it invokes third-party code, introduces a random delay to evade detection, and only fires on servers where a specific backend method of Digitain's FG-Crash crash game is present. For everyone else, the library remains just a library — no credential theft, no persistence, no lateral movement. Its sole purpose is to undermine the fairness of one particular game.

The malware sends the rigged round results to a hardcoded server, 185.126.237.64:5341, disguising them as telemetry and using the distinctive header X-Seq-ApiKey: theperfectheist2025.

Three generations and an accidentally clean build

According to JFrog, the seven versions fall into three generations, published between August 13 and October 10, 2025, and they show how the author refined the implant step by step. The first generation was a local “proof of concept” with no data exfiltration. The second added exfiltration, hidden behind reflection and the ConfuserEx obfuscator. The third cleaned up the rigging logic and stabilized the data transmission. Amusingly, version 11.0.11 turned out to have no obfuscation at all — it seems the author inadvertently shipped a “clean” debug build.

Another pointer to Digitain's involvement is that the package metadata leaks the internal URL of the FG-Crash repository seven times — meaning the author had access to the game's source code.

Developers are advised to remove the doppelgänger package, block the C2 server's address, and pin a trusted version of Newtonsoft.Json via packages.lock.json. Digitain itself said it was aware of the problem and had taken measures, though the full extent of the compromise remains unknown.

Source: The Hacker News