About 1,200 developers have already downloaded the malicious typosquat NuGet package that pretends to be Newtonsoft.Json, yet it silently rigs results on Digitain’s online crash game. The package, named Newtonsoftt.Json.Net, was published under versions 11.0.4 through 11.0.11 and is now unlisted, but the artifacts remain reachable from the registry.
Key Takeaways
- Seven versions (11.0.4‑11.0.11) of a trojanized Newtonsoft.Json fork were uploaded to NuGet between August 13 and October 10, 2025.
- The package has been downloaded roughly 1,200 times and targets only the Digitain crash‑game backend.
- Malicious code activates when JsonConvert.DefaultSettings is assigned, inserting a delayed payload that exfiltrates rigged results to 185.126.237[.]64:5341.
- Non‑targeted developers receive a functional JSON library with no observable side effects.
- Mitigation includes removing the package, blocking the C2 address, and pinning Newtonsoft.Json via
packages.lock.json.
Typosquat NuGet Package Used to Rig Digitain Game Results
When the package first appeared, JFrog security researcher Guy Korolevski described the behavior as “developers who install it by typo get a real, working Newtonsoft.Json build; the malicious behavior begins after the host initializes JsonConvert.DefaultSettings, and can only succeed on systems that expose the target’s specific game backend method, and only after a delay.” That’s the catch. The malicious code isn’t a generic info‑stealer; it’s laser‑focused on one betting platform.
Background: Typosquatting in Package Repositories
Typosquatting exploits the fact that developers often type package names quickly, trusting autocomplete or copy‑paste. In public registries, a single extra character can create a new namespace that looks legitimate. Attackers have used this pattern to publish malicious forks of popular libraries, banking on the probability that a typo will slip through code reviews or CI pipelines.
Historically, supply‑chain incidents have ranged from credential harvesters to ransomware droppers. The current case differs because the payload is highly selective. Instead of stealing data from any host, it waits for a very specific method signature tied to Digitain’s crash‑game backend. That precision reduces the chance of accidental detection while still delivering a lucrative payoff for the adversary.
Because the malicious package still compiles and runs as a proper JSON serializer, most unit tests pass. Developers see no compile‑time errors, and runtime behavior appears normal until the targeted method is invoked. This blend of functional fidelity and hidden logic makes typosquats especially dangerous in large monorepos where dependency graphs are deep and sometimes opaque.
How the Malicious Fork Operates
The backdoor lives inside the DefaultSettings property setter. When an application assigns JsonConvert.DefaultSettings, the altered setter injects a randomized delay to dodge detection, then runs code that patches a method unique to Digitain’s FG‑Crash backend. The payload masquerades as telemetry, sending rigged round results to a hard‑coded address using the custom header X-Seq-ApiKey: theperfectheist2025. The exfiltration point is 185.126.237[.]64:5341, which attackers control.
“The trojan rigs Digitain, an online betting platform, and in later generations, exfiltrates rigged round results to an attacker‑controlled server, using the header X-Seq-ApiKey: theperfectheist2025,” according to JFrog.
Because the library still performs its core JSON functions, most applications continue to work normally. Only when the specific Digitain method is present does the malicious branch fire. That narrow trigger makes the attack both subtle and effective.
Technical Architecture of the Backdoor
At runtime, the modified DefaultSettings setter first checks whether the calling assembly matches the known Digitain namespace pattern. If the check passes, the code uses reflection to locate a private method that calculates round outcomes. The reflection call is wrapped in a try‑catch block, ensuring that any failure silently falls back to the original implementation.
Before invoking the patched method, the backdoor generates a random sleep interval ranging from a few seconds to tens of seconds. This delay spreads out network traffic and makes timing analysis harder for defenders. Once the pause expires, the code constructs a small JSON payload containing the manipulated round result, then opens a TCP socket to the hard‑coded IP address.
The custom header X-Seq-ApiKey acts as a shared secret between the compromised host and the attacker’s server. The header value is static and hard‑coded, meaning that any host that reaches the endpoint can be identified immediately. The payload is sent over an unencrypted channel, which is acceptable for the attacker because the data is already compromised by design.
Finally, the backdoor disposes of the socket and returns control to the original method. Because the surrounding application receives the expected data type, downstream logic proceeds without interruption. This design keeps the malicious activity invisible to standard logging or exception monitoring.
Timeline and Versions Released
All seven published versions contain the same trojanized fork of Newtonsoft.Json 13.0. They were rolled out in three generational waves:
- Gen‑1 (11.0.4‑11.0.5): a local‑only rigging proof‑of‑concept.
- Gen‑2 (11.0.7‑11.0.8): added exfiltration, hidden behind reflection and ConfuserEx.
- Gen‑3 (11.0.9‑11.0.11): cleaned up rigging, stabilized exfiltration; version 11.0.11 was unintentionally unobfuscated.
Each version was published between August 13 and October 10, 2025. The author, identified as MagicalPuff96, later unlisted the package, which means it won’t appear in NuGet searches, but the files stay downloadable via direct URLs.
Impact on Digitain and the Gaming Industry
Digitain, operator of the FG‑Crash betting game, is the primary victim. Package metadata leaked an internal Digitain repository URL seven times across all versions, confirming the author had access to the game’s source code. The rigging alters round results, giving attackers a way to manipulate outcomes and profit from bets placed on the compromised server.
There’s no credential theft, persistence, or lateral‑movement capability in the payload. Its sole purpose is to compromise the integrity of the crash game. That’s why non‑targeted developers may never notice any abnormal behavior; the malicious code simply never triggers for them.
Mitigation Steps for Developers
If you’ve installed Newtonsoftt.Json.Net—even by accident—you should take immediate action. First, remove the package from your project files and clear any cached copies. Next, block outbound traffic to 185.126.237[.]64:5341 at the firewall level. Finally, pin the legitimate Newtonsoft.Json library to a known‑good version using a packages.lock.json file to prevent future typosquats.
Digitain has confirmed it’s aware of the issue and is working on a fix, but the full extent of exposure remains unknown. Developers should also audit their dependency lists for any similarly named packages, especially those that appear to be popular libraries with a single‑character typo.
What This Means For You
For developers, the takeaway is clear: a single typo in a package name can open a backdoor that only activates under very specific conditions, yet it can still cause financial loss for a third party. You’ll want to audit your CI/CD pipelines for accidental imports of Newtonsoftt.Json.Net and enforce strict package name validation.
For founders and security teams, the incident underscores the need for supply‑chain monitoring that goes beyond generic malware scans. You’ll need to watch for unusual package metadata, such as leaked internal URLs, and set up alerts for any download of packages that closely resemble trusted libraries.
Scenario 1: A junior engineer adds the package to a microservice that processes betting data. The service compiles, passes tests, and ships to production. Hours later, the rigged payload fires, sending altered odds to the attacker. The company sees a sudden dip in revenue without any obvious code change.
Scenario 2: An automated build system pulls dependencies from a cached feed. The feed contains the malicious NuGet, and the build succeeds. Because the feed is shared across multiple projects, several unrelated services unknowingly include the backdoor, expanding the attack surface.
Scenario 3: A security audit flags a package name that differs by one character from a core library. The auditor discovers the malicious version, removes it, and updates the lock file. The team then implements a policy that rejects any package whose name is not on an approved list.
Will supply‑chain attacks continue to evolve toward niche, high‑value targets like this, or will broader defenses finally curb the trend? Only.
Key Questions Remaining
- How many other projects, beyond those publicly disclosed, have imported the typosquat package?
- What detection mechanisms can reliably spot the delayed‑execution pattern without generating false positives?
- Can the hard‑coded C2 address be seized or neutralized to disrupt the exfiltration channel?
- Will package registries introduce automated similarity checks to block future typosquats before they become available?
- How will the gaming industry adapt its threat‑model to account for supply‑chain compromises that target game‑logic functions?
Sources: The Hacker News, JFrog
