Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library
A NuGet package named "Newtonsoftt.Json.Net" (typosquatting the popular Newtonsoft.Json library) was discovered containing a trojanized fork designed to rig live game results on the Digitain betting platform. The malware exhibits highly targeted behavior, remaining benign for general users while activating only when specific conditions are met, such as the initialization of `JsonConvert.DefaultSettings` and the presence of Digitain’s specific backend methods. The attack evolved through three gen
Analysis
TL;DR
- A NuGet package named "Newtonsoftt.Json.Net" (typosquatting the popular Newtonsoft.Json library) was discovered containing a trojanized fork designed to rig live game results on the Digitain betting platform.
- The malware exhibits highly targeted behavior, remaining benign for general users while activating only when specific conditions are met, such as the initialization of
JsonConvert.DefaultSettingsand the presence of Digitain’s specific backend methods. - The attack evolved through three generations, progressing from a local proof-of-concept to sophisticated exfiltration using obfuscation tools like ConfuserEx, ultimately sending rigged data to a hardcoded C2 server disguised as telemetry.
- Security researchers from JFrog highlighted the package's stealth capabilities, noting that it leaks internal repository URLs in metadata, suggesting the attacker had prior access to the victim's source code.
Why It Matters
This incident represents a significant evolution in supply chain attacks, moving beyond generic credential theft to precise, business-logic exploitation within specific enterprise environments. It demonstrates how attackers can weaponize widely used open-source dependencies to target niche infrastructure without triggering broad alarms, making traditional security monitoring less effective. For AI and software engineering communities, it underscores the critical need for dependency pinning and rigorous auditing of third-party libraries, especially those with slight naming variations.
Technical Details
- Targeting Mechanism: The trojan checks for the existence of specific methods in the host environment related to Digitain’s FG-Crash backend. It only executes malicious logic if these methods are present, ensuring invisibility to non-targeted applications.
- Activation Trigger: Malicious code is invoked via the
DefaultSettingsproperty setter ofJsonConvert. The attacker introduced randomized delays to evade static analysis and behavioral detection during the initialization phase. - Evolution of Payload: The package versions span three generations: Gen-1 was a local-only rigging test; Gen-2 added exfiltration hidden behind reflection and ConfuserEx obfuscation; Gen-3 stabilized the exfiltration path, with the final version (11.0.11) appearing unobfuscated, possibly due to an accidental clean build.
- Data Exfiltration: Rigged game results are sent to the IP address
185.126.237[.]64:5341using the HTTP headerX-Seq-ApiKey: theperfectheist2025, masquerading as legitimate telemetry data to avoid network-level suspicion. - Metadata Leakage: All seven published versions contained an internal Digitain repository URL in their package metadata, providing evidence that the attacker likely had insider knowledge or access to the victim's development environment.
Industry Insight
- Enhanced Dependency Auditing: Organizations must implement strict dependency locking (e.g.,
packages.lock.json) and verify package hashes against official sources to prevent the installation of typosquatted libraries, even if they appear functionally correct. - Behavioral Monitoring for Supply Chains: Traditional signature-based detection is insufficient for targeted supply chain attacks. Security teams should monitor for anomalous outbound traffic patterns and unexpected API calls from standard libraries, particularly those involving unusual headers or destinations.
- Risk of Insider Threats: The presence of internal URLs in the package metadata suggests potential insider involvement or compromised developer credentials. Companies should enforce least-privilege access controls and regularly audit external communications from development environments to mitigate insider risks.
Disclaimer: The above content is generated by AI and is for reference only.