"The trojan rigs Digitain, an online betting platform, and in later generations, exfiltrates rigged round results to an attacker-controlled server, utilizing the header X-Seq-ApiKey: theperfectheist2025," JFrog reported.
Mechanics of the trojanized Newtonsoftt.Json.Net
Researchers found a trojanized NuGet package named "Newtonsoftt.Json.Net" that masquerades as the popular Newtonsoft.Json library while hiding a targeted backdoor. The malicious code is embedded in a forked build of Newtonsoft.Json 13.0 and is delivered in seven published package versions: 11.0.4, 11.0.5, 11.0.7, 11.0.8, 11.0.9, 11.0.10, and 11.0.11. All seven versions contain the same trojanized fork, and the package has been downloaded about 1,200 times to date.
How the backdoor activates and what it does
The backdoor activates only when an application assigns JsonConvert.DefaultSettings. The DefaultSettings property setter was altered to invoke attacker-controlled code that first introduces a randomized delay—an intentional anti-detection measure—before carrying out its malicious actions. The trojan’s logic attempts to identify and patch a specific method present in the FG-Crash backend used by Digitain; when that method is present, the package rigs crash-game results and, in later generations, sends those rigged results to an attacker-controlled endpoint.
Evidence tying the trojan to Digitain’s FG-Crash backend
JFrog’s analysis points to Digitain’s FG-Crash game as the primary victim. Package metadata in every published version was found to leak an internal Digitain repository URL seven times, which JFrog says indicates the author had access to FG-Crash source code. Guy Korolevski, a JFrog security researcher, summarized the targeting: "The trojan only activates when JsonConvert.DefaultSettings is assigned and only patches a method present in the FG-Crash backend." The exfiltration endpoint was hard-coded and disguised as telemetry data, targeting 185.126.237[.]64:5341 and using the HTTP header X-Seq-ApiKey: theperfectheist2025.
Evolution across three generations and obfuscation techniques
JFrog describes three developmental generations published between August 13 and October 10, 2025. Gen‑1 functioned as a local-only rigging proof of concept. Gen‑2 added exfiltration and hid malicious behavior behind reflection and ConfuserEx obfuscation. Gen‑3 refined the rigging logic and stabilized exfiltration. JFrog noted that version 11.0.11 was left completely unobfuscated, which it said is "consistent with an accidental clean build being published." Across versions the primary changes were obfuscation, rigging strategy, and exfiltration path—evidence of iterative hardening by the package author.
Mitigation advice, impact, and company response
JFrog’s advisory emphasizes that non-targeted consumers installing the package may only see a working JSON library and never observe the rigging behavior—precisely the vector that makes this typosquat effective. JFrog also pointed out that the payload contains "no credential theft, persistence, or lateral-movement capability"; its "sole purpose is to compromise the integrity of the crash game." Recommended mitigations include removing the typosquat package, blocking the command-and-control/exfiltration address, and pinning Newtonsoft.Json to a known-good version via packages.lock.json. Digitain has publicly acknowledged awareness of the issue and stated it has taken steps to resolve it, but JFrog notes the full extent of exposure remains unknown.
What this means for developers, Digitain, and incident responders
- Developers: Packages unlisted from a registry can still be downloaded; a typo in a package name can yield code that behaves correctly for most consumers while carrying a concealed, conditional payload. Developers are advised to pin dependencies and inspect unexpected package metadata.
- Digitain (FG-Crash operators): The evidence that internal repository URLs leaked from the package and the trojan’s targeting of an FG-Crash backend method mean the company must verify whether rigged rounds reached production and whether exfiltration occurred to 185.126.237[.]64:5341 using X-Seq-ApiKey: theperfectheist2025.
- Incident responders: The malware's conditional activation and staged obfuscation complicate detection; responders should look for unauthorized assignments to JsonConvert.DefaultSettings in deployed binaries and for telemetry-like traffic to the hard-coded exfiltration host and header.
This episode underscores a simple but hazardous reality: a library that appears to work correctly for most consumers can still carry a narrowly tailored integrity attack. The discovery ties a typosquat to a concrete target, shows iterative development of the payload across multiple releases, and leaves at least one operator — Digitain — to determine how far the compromise went.
https://thehackernews.com/2026/07/trojanized-newtonsoftjson-fork-hides.html
