Cybersecurity researchers have identified a malicious NuGet package named “Newtonsoftt.Json.Net” that specifically targets Digitain’s FG-Crash betting game. This package, a trojanized version of the widely-used Newtonsoft.Json library, has been downloaded approximately 1,200 times.
The package was published in seven versions—11.0.4 through 11.0.11—between August 13 and October 10, 2025. Although the owner, “MagicalPuff96,” has unlisted the package, making it invisible in NuGet searches, the artifacts remain accessible for download.
Unlike typical malware that indiscriminately steals information, this trojan is designed to manipulate live game results on Digitain’s platform. It functions as expected for general users but activates its malicious behavior when the host application initializes the JsonConvert.DefaultSettings property. This behavior is specifically triggered on systems running the FG-Crash game’s backend.
The backdoor initiates through the DefaultSettings property setter, which has been modified to execute attacker-controlled code. This code introduces a randomized delay to evade detection before executing its payload. The primary objective is to compromise the integrity of the FG-Crash game by exfiltrating manipulated game results to a hard-coded server address (“185.126.237[.]64:5341”), disguising this data as telemetry information.
Over its three generations, the trojan has evolved in obfuscation techniques, rigging strategies, and exfiltration methods. The first generation served as a local proof of concept, the second added exfiltration capabilities concealed behind reflection and ConfuserEx obfuscation, and the third refined the rigging process and stabilized exfiltration, with version 11.0.11 being left unobfuscated, possibly due to an accidental clean build publication.
Metadata analysis of the package revealed internal Digitain repository URLs, suggesting that the attacker had access to FG-Crash’s source code. The trojan activates only when JsonConvert.DefaultSettings is assigned and specifically patches a method present in the FG-Crash backend. Non-targeted users may experience no adverse effects, making this typosquatting attack particularly insidious.
To mitigate this threat, developers are advised to remove the malicious package, block the associated command-and-control server address, and pin Newtonsoft.Json to a known safe version using packages.lock.json. Digitain has acknowledged the issue and is taking steps to address it, though the full extent of the exposure remains uncertain.
This incident underscores the growing sophistication of supply chain attacks, where malicious actors exploit trusted libraries to target specific organizations. It highlights the critical need for developers to exercise caution when incorporating third-party packages, verify the authenticity of libraries, and implement robust security practices to safeguard their applications and users.
