Cybersecurity researchers have identified a malicious NuGet package that disguised itself as the widely used Newtonsoft.Json library while secretly targeting the Digitain online gaming platform. The package, named Newtonsoftt.Json.Net, was published as a trojanized fork of the legitimate Newtonsoft.Json library and differs from many software supply chain attacks because it was designed to manipulate live game results instead of stealing user credentials or deploying conventional malware. According to security researchers at JFrog, seven versions of the package were uploaded to the NuGet repository, including versions 11.0.4, 11.0.5, 11.0.7, 11.0.8, 11.0.9, 11.0.10, and 11.0.11. The package has been downloaded approximately 1,200 times. Although the package has since been unlisted by its publisher, MagicalPuff96, it remains accessible through the registry, meaning users who know the direct package location can still download it.
JFrog researchers found that the malicious package was designed to appear and function like the legitimate Newtonsoft.Json library for most users, making the attack particularly difficult to detect. Developers who accidentally installed the package through a typographical error received a fully functional JSON library with no obvious signs of malicious activity. The hidden functionality only became active after the host application initialized the JsonConvert.DefaultSettings property and only on systems containing Digitain’s specific game backend. Once activated, the modified library introduced a randomized delay before executing its malicious code, a technique intended to reduce the likelihood of detection during security analysis. The attack specifically targeted Digitain’s FG Crash betting game by manipulating game results and sending altered information to an attacker controlled server while disguising the traffic as legitimate telemetry data. Researchers stated that the malicious package used a hard coded communication endpoint and transmitted information using a custom HTTP header identified as X Seq ApiKey: theperfectheist2025.
The investigation revealed that all seven published versions were based on the same trojanized fork of Newtonsoft.Json version 13.0 but evolved through three separate development stages published between August 13 and October 10, 2025. According to JFrog, the earliest generation acted as a proof of concept focused only on local game manipulation. Later versions introduced data exfiltration capabilities while using reflection techniques and ConfuserEx obfuscation to conceal malicious behavior. The third generation refined the game manipulation process and improved the stability of the exfiltration mechanism, while version 11.0.11 appeared to have been published without obfuscation, suggesting it may have been an unintended clean build. Researchers also discovered that package metadata repeatedly exposed an internal Digitain repository address, indicating the developer may have had access to the source code for the FG Crash application. Despite the sophistication of the attack, researchers emphasized that the malware was highly targeted and did not include capabilities commonly associated with broader malware campaigns such as credential theft, persistence, or lateral movement. Instead, its sole objective was to manipulate the integrity of Digitain’s crash game platform while remaining invisible to other users.
JFrog advised developers to immediately remove the malicious typosquatting package, block communication with the identified command and control server, and pin the legitimate Newtonsoft.Json package to a trusted version using packages.lock.json to reduce the risk of accidental dependency replacement. Researchers noted that because the malware only activates under highly specific conditions, many developers who installed the package may never realize that they had included malicious software in their projects. Digitain confirmed that it was already aware of the issue and stated that steps had been taken to address the threat affecting its systems. However, researchers indicated that the overall extent of exposure has not yet been fully determined, highlighting the continued importance of verifying software dependencies and monitoring package repositories for typosquatting attacks targeting software supply chains.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.