JFrog: NuGet Typosquat Rigs Betting Outcomes at Digitain

What it is

Newtonsoftt.Json.Net (note the doubled t and .Net suffix) — a NuGet typosquat of Newtonsoft.Json. It ships a fully working trojanized fork of Newtonsoft.Json 13.0.3, so serialization behaves normally and tests pass. The nuspec forges the identity of the real library: author James Newton-King, projectUrl https://www.newtonsoft.com/json, title Json.NET, MIT license, tag json. The version scheme is 11.0.x (real Json.NET is on 13.x, so 11.x looks unremarkable in a dependency graph rather than obviously wrong).

How it works

NuGet auto-references every assembly under lib/net8.0/, so adding the "JSON library" silently loads three DLLs into the host process:

• Newtonsoft.Json.net.dll — the trojanized fork containing the trigger
• Newtonsoft.Values.Net.dll — the payload, imported by the JSON lib
• 0Harmony.dll — upstream HarmonyLib runtime-patching (dual-use, benign alone)

The trigger fires from the JsonConvert.DefaultSettings setter, a common startup config point. The setter silently discards the host's ContractResolver, substitutes its own CamelCasePropertyNamesContractResolver, then calls DefaultValues.Set() to launch the payload. Later generations exfiltrate rigged results to an attacker server using the HTTP header X-Seq-ApiKey: theperfectheist2025.

Preconditions / Affected

Malicious behavior only succeeds on hosts exposing Digitain's specific game-backend method (the Harmony patch target), and only after a delay following JsonConvert.DefaultSettings initialization. On every other system it is just a working JSON library — which is why nobody goes looking. The package was discoverable on NuGet August–October 2025.

What to do

Grep dependency graphs and lockfiles for the exact package id — the doubled t is the tell:

• Package: Newtonsoftt.Json.Net, versions in the 11.0.x scheme (e.g. 11.0.11)
• Assemblies: Newtonsoft.Json.net.dll, Newtonsoft.Values.Net.dll shipped together
• Network/proxy detection: outbound requests carrying header X-Seq-ApiKey: theperfectheist2025
• Metadata tell: any package whose nuspec repository URL points at Digitain's internal TFS server / BetOnGames / FG-Crash

Caveats

• The package is now unlisted, not removed — it won't appear in NuGet search, but at time of writing all artifacts are still downloadable directly from the package page.
• Version-to-generation mapping is odd: Gen-1 was published after Gen-2 variants, and Gen-3's 11.0.11 shipped completely unobfuscated (JFrog speculates an accidental clean build or expired obfuscator trial, but cannot confirm).
• This is a targeted fraud tool against one operator, not a generic info-stealer — the payload does nothing harmful on hosts lacking Digitain's backend, so absence of visible impact does not mean absence of the package.