Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library
Summary: Researchers at JFrog found a NuGet typosquat named "Newtonsoftt.Json.Net" that ships a trojanized fork of Newtonsoft.Json 13.0 across seven versions published between August 13 and October 10, 2025, downloaded about 1,200 times. The package works as a normal JSON library but, after JsonConvert.DefaultSettings is assigned, introduces a randomized delay and patches a method present only in Digitain's FG-Crash backend to rig game results and exfiltrate them to 185.126.237[.]64:5341 under the header X-Seq-ApiKey: theperfectheist2025.
What you should know: The package metadata leaked an internal Digitain repository URL in all seven versions, indicating the author had access to FG-Crash source code, and Digitain says it has taken steps to resolve the issue while the full extent of the exposure remains unknown.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026