Cybersecurity researchers at **JFrog** have revealed a novel supply chain attack leveraging a typosquatted **NuGet** package to manipulate online game outcomes. The malicious package, named `Newtonsoftt.Json.Net`, masquerades as the legitimate and widely used **Newtonsoft.Json** library.  ### The Malicious Package Seven versions of `Newtonsoftt.Json.Net` (11.0.4, 11.0.5, 11.0.7, 11.0.8, 11.0.9, 11.0.10, and 11.0.11) were published to the **NuGet** repository between August 13 and October 10, 2025. Despite being unlisted by its owner, **MagicalPuff96**, the artifacts remain available for download and have accumulated approximately 1,200 downloads. ### Targeted Attack Mechanism What sets this attack apart is its hyper-specific targeting. The trojan's primary objective is to rig **Digitain**, an online betting platform, specifically affecting its crash-game backend. Later generations of the malware also exfiltrate rigged round results to an attacker-controlled server using the header `X-Seq-ApiKey: theperfectheist2025`. According to **Guy Korolevski**, a **JFrog** security researcher, the malicious behavior only activates under specific conditions: > "Developers who install it by typo get a real, working **Newtonsoft.Json** build; the malicious behavior begins after the host initializes **JsonConvert.DefaultSettings**, and can only succeed on systems that expose the target's specific game backend method, and only after a delay." ### Evolving Payload and Obfuscation All seven published versions contain a trojanized fork of **Newtonsoft.Json** 13.0, spread across three generations. The backdoor initializes via an altered `DefaultSettings` property setter, which invokes attacker-controlled code. This code introduces a randomized delay to evade detection before firing the malicious functionality. The ultimate goal is to target servers running **Digitain's** crash-game backend and exfiltrate manipulated results to a hard-coded command-and-control (C2) address (`185.126.237[.]64:5341`), disguised as telemetry data.  **JFrog** notes the progression of the threat: > "What changes across versions is the obfuscation, the rigging strategy, and the exfiltration path. The progression shows the author iteratively hardening the payload: Gen-1 was a local-only rigging proof of concept; Gen-2 added exfiltration but hid it behind reflection and **ConfuserEx**, Gen-3 cleaned up the rigging and stabilized the exfiltration, with 11.0.11 left completely unobfuscated, consistent with an accidental clean build being published." ### Evidence of Insider Access Intriguingly, the package metadata for all versions leaked an internal **Digitain** repository URL seven times, strongly suggesting the author had direct access to the source code of **Digitain's** FG-Crash game. This level of access underscores the sophistication of the attack. > "The trojan only activates when **JsonConvert.DefaultSettings** is assigned and only patches a method present in the FG-Crash backend," **Korolevski** added. "Non-targeted consumers may see only a working JSON library and no rigging behavior, which is exactly what makes this typosquat attack so effective." The payload focuses solely on compromising the integrity of the crash game, without credential theft, persistence, or lateral movement capabilities. This specialized nature means developers who installed the package accidentally might not even realize their systems were compromised if they weren't running the specific target application. ### Mitigation and Response To mitigate this threat, developers are advised to: * Remove the typosquat package (`Newtonsoftt.Json.Net`). * Block the identified command-and-control (C2) address (`185.126.237[.]64:5341`). * Pin **Newtonsoft.Json** to a known-good version using `packages.lock.json`. **Digitain** has acknowledged awareness of the issue and stated that steps have been taken to resolve it, although the full extent of the exposure remains under investigation.