Cybersecurity researchers have discovered a NuGet typosquat that’s unlike the typical information-stealing malware distributed via package registries: usual info-stealers: it’s designed to rig live game results on Digitain.
The package, named “Newtonsoftt.Json.Net,” masquerades as the Newtonsoft.Json library and is a trojanized fork. Seven versions of the package have been published to the NuGet repository: 11.0.4, 11.0.5, 11.0.7, 11.0.8, 11.0.9, 11.0.10, and 11.0.11. The package has been downloaded about 1,200 times to date.
The package has been unlisted by its owner MagicalPuff96, meaning it will not be surfaced via a search on NuGet. However, the artifacts are still available for download from the registry.
“The trojan rigs Digitain, an online betting platform, and in later generations, exfiltrates rigged round results to an attacker-controlled server, utilizing the header X-Seq-ApiKey: theperfectheist2025,” according to JFrog.
What’s notable about the package is that it specifically goes after a single entity, while functioning as expected for other users.
“Developers who install it by typo get a real, working Newtonsoft.Json build; the malicious behavior begins after the host initializes JsonConvert.DefaultSettings, and can only succeed on systems that expose the target’s specific game backend method, and only after a delay,” Guy Korolevski, JFrog security researcher, said.
All seven published versions contain the same trojanized fork of Newtonsoft.Json 13.0. spread across three generations that were published between August 13 and October 10, 2025.
The backdoor initiates itself via the DefaultSettings property setter, which has been altered such that it invokes attacker-controlled code to introduce a randomized delay as a way to sidestep detection before the malicious functionality is fired. The end goal is to target servers running Digitain’s crash-game backend, and exfiltrate rigged results to a hard-coded exfiltration point (“185.126.237[.]64:5341”) by masquerading it as telemetry data.
“What changes across versions is the obfuscation, the rigging strategy, and the exfiltration path,” JFrog explained. “The progression shows the author iteratively hardening the payload: Gen-1 was a local-only rigging proof of concept; Gen-2 added exfiltration but hid it behind reflection and ConfuserEx, Gen-3 cleaned up the rigging and stabilized the exfiltration, with 11.0.11 left completely unobfuscated, consistent with an accidental clean build being published.”
The primary victim of the rigging is Digitain, the operator of the FG-Crash betting game. The package metadata has been found to leak an internal Digitain repository URL seven times (in all the package versions), indicating the author had access to FG-Crash’s source code.
“The trojan only activates when JsonConvert.DefaultSettings is assigned and only patches a method present in the FG-Crash backend,” Korolevski said. “Non-targeted consumers may see only a working JSON library and no rigging behavior, which is exactly what makes this typosquat attack so effective.”
“There is no credential theft, persistence, or lateral-movement capability in the payload. Its sole purpose is to compromise the integrity of the crash game. Other developers who installed this package may not even notice that they installed malware, or have any negative results in their application since it is only targeting a specific organization.”
To counter the threat, developers are advised to remove the typosquat package, block the command-and-control (C2) address, and pin Newtonsoft.Json to a known-good version via packages.lock.json. Digitain, for its part, has revealed it’s been aware of the issue and that it has taken steps to resolve it. That having said, the full extent of the exposure remains unknown.
