Typosquatted NuGet Package Targets Digitain, Rigs Betting Outcomes via JSON Library

A single doubled letter turned a trusted .NET library into a weapon against an online gambling operator. JFrog Security Research has disclosed a typosquatted NuGet package, Newtonsoftt.Json.Net, that impersonated the ubiquitous Newtonsoft.

Json library while secretly patching the game logic of Digitain’s FG-Crash betting platform to rig outcomes and exfiltrate results to an attacker-controlled server.

The package lived on NuGet from August to October 2025 before being unlisted, though all seven published versions remain downloadable directly from its package page.

Typosquatted NuGet Package Targets Digitain

Unlike typical supply-chain malware that casts a wide net for credentials or system access, this trojan was a precision instrument built for one target.

The nuspec metadata for Newtonsoftt.Json.Net was engineered to survive a casual glance. It listed James Newton-King as author, pointed to the real Newtonsoft.com project URL, claimed the MIT license, and used a 11.0.x versioning scheme old enough to seem plausible next to the real library’s 13.x line.

Inside, the package shipped three DLLs: a trojanized fork of Newtonsoft.Json 13.0.3, a payload assembly called Newtonsoft.Values.Net.dll, and a bundled copy of HarmonyLib, a legitimate runtime-patching tool repurposed here for malicious IL rewriting.

Because NuGet auto-references every assembly in the lib folder, installing the fake package silently loaded all three components into a host process. The forked JSON library still serialized correctly, so tests passed and nothing looked broken.

Notably, every version’s metadata leaked the same internal Digitain TFS repository URL, pointing at a project called BetOnGames/FG-Crash. The attacker effectively named their target seven times over.

JFrog’s analysis of all seven releases revealed a clear evolution in sophistication:

• Gen-1 (11.0.7, 11.0.8): Dotfuscator-obfuscated, no networking, just a local proof-of-concept that rigged results and printed them to console.
• Gen-2 (11.0.4, 11.0.5, 11.0.9): ConfuserEx-heavy obfuscation, added reflection-based exfiltration to hide the C2 call from static analysis.
• Gen-3 (11.0.10, 11.0.11): Simplified to a clean Harmony postfix, with 11.0.11 shipped completely unobfuscated, exposing the full attack chain in plaintext.

The malware activated through JsonConvert.DefaultSettings, a common Json.NET startup hook. Setting it silently swapped in the attacker’s own contract resolver and armed a delayed timer, ten minutes in Gen-3, until the next afternoon in Gen-1. This delay pushed the malicious activation well past startup logging and monitoring windows.

Once triggered, Harmony patched a single method: Digitain.FG.SharedCrash.GameLogic.SharedCrashRules.GenerateGameResult. Gen-1 rewrote IL to swap crash-coefficient constants using lookup tables keyed to the date.

Gen-3 simplified this to a postfix overwriting the method’s return value directly, bounded to a fixed number of rigged rounds before self-unpatching, making manipulation nearly invisible in aggregate data.

Gen-3 posted rigged results to 185.126.237.64:5341/api/events/raw, using the header X-Seq-ApiKey: theperfectheist2025.

This mimicked Seq, a legitimate structured-logging service, down to the endpoint path and JSON event shape, letting malicious traffic blend into ordinary application telemetry.

Non-targeted developers who installed the typo’d package got a fully functional JSON library with no visible side effects, since the payload only activates on systems exposing Digitain’s specific game backend method.

For Digitain, the impact was direct financial fraud: rigged rounds, an off-platform audit trail for the attacker, and persistent compromise tied to a mislabeled dependency.

JFrog disclosed the package to Digitain on July 7, 2026. The company responded two days later, confirming it was already aware of the issue and had resolved it, though the full exposure window remains unconfirmed.

Affected teams should:

• Remove the fake dependency and rebuild from the official Newtonsoft.Json 13.0.3+
• Purge cached copies from local and internal NuGet feeds
• Block egress to 185.126.237.64:5341 and audit historical logs
• Pin dependencies via packages.lock.json and adopt a private feed allow-list

This case underscores a quieter supply-chain risk: a package doesn’t need broad malicious behavior to be dangerous; it just needs to recognize the one environment it was built to hit.

About the Author

Potheeswaran

Author

Visit Website View All Posts