Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library
A typosquatted version of the Newtonsoft.Json library has been discovered, designed to rig live game results on Digitain, an online betting platform. The package, disguised as a legitimate library, exfiltrates rigged data to a command-and-control server. Researchers found seven versions of the package, with the author iteratively hardening the payload to evade detection. Digitain has been aware of the issue and is taking steps to address it.
A typosquatted version of the Newtonsoft.Json library has been discovered, designed to rig live game results on Digitain, an online betting platform. The package, named "Newtonsoftt.Json.Net," masquerades as the legitimate Newtonsoft.Json library and has been downloaded approximately 1,200 times. The package has been unlisted by its owner, MagicalPuff96, meaning it will not be surfaced via a search on NuGet, but the artifacts remain available.
Researchers found seven versions of the package (11.0.4, 11.0.5, 11.0.7, 11.0.8, 11.0.9, 11.0.10, and 11.0.11) spread across three generations, with the author iteratively hardening the payload to evade detection. The package only activates when JsonConvert.DefaultSettings is assigned and only patches a method present in the FG-Crash backend. Non-targeted consumers may see only a working JSON library and no rigging behavior, which is exactly what makes this typosquat attack so effective.
The primary victim of the rigging is Digitain, the operator of the FG-Crash betting game. The package metadata has been found to leak an internal Digitain repository URL seven times (in all the package versions), indicating the author had access to FG-Crash's source code. The package utilizes a randomized delay to bypass detection before exfiltrating rigged results to a hard-coded exfiltration point ("185.126.237[.]64:5341") under the guise of telemetry data.
To counter the threat, developers are advised to remove the typosquat package, block the command-and-control (C2) address, and pin Newtonsoft.Json to a known-good version via packages.lock.json. Digitain has revealed it's been aware of the issue and that it has taken steps to resolve it. The full extent of the exposure remains unknown.