Listen to this Post
Introduction: A Supply Chain Attack Designed for a Single Victim
Software supply chain attacks have become one of the greatest cybersecurity challenges of the modern era. In recent years, attackers have increasingly abused trusted package repositories such as NuGet, npm, and PyPI to distribute malicious code under the disguise of legitimate software libraries. Most of these campaigns share a familiar goal, stealing credentials, cryptocurrency wallets, API tokens, or sensitive developer information.
However, cybersecurity researchers have now uncovered something entirely different.
Instead of infecting thousands of victims for financial theft, this malicious NuGet package appears to have been engineered with incredible precision. Its objective was not widespread malware deployment, but secretly manipulating the outcome of games running on Digitain’s online betting platform. The discovery highlights how software supply chain attacks are evolving beyond traditional espionage and data theft into highly specialized operations that directly threaten business integrity.
A Fake Newtonsoft Package Hides a Sophisticated Trojan
Security researchers at JFrog discovered a malicious NuGet package named Newtonsoftt.Json.Net, carefully crafted to resemble the enormously popular Newtonsoft.Json library.
The extra “t” in the package name is subtle enough that many developers could install it accidentally without noticing.
Unlike many fake packages that immediately reveal malicious behavior, this one delivers a fully functional JSON library. Applications continue working normally, making the package appear completely legitimate.
This deceptive design dramatically lowers suspicion and allows malicious functionality to remain hidden for extended periods.
Seven separate versions of the package were uploaded:
11.0.4
11.0.5
11.0.7
11.0.8
11.0.9
11.0.10
11.0.11
Collectively, the package accumulated approximately 1,200 downloads before being unlisted from NuGet. Although hidden from repository searches, the package artifacts remain downloadable.
Unlike Traditional Malware, This Attack Targets Only One Organization
Most malicious packages attempt to infect every possible system they encounter.
This campaign does exactly the opposite.
Researchers discovered the malicious code activates only when very specific application conditions are met.
If the package is installed in ordinary software, developers simply receive a working JSON library.
Only systems matching
This makes the malware incredibly stealthy because virtually every unintended victim experiences no obvious malicious behavior.
How the Hidden Payload Works
The attackers modified the JsonConvert.DefaultSettings property inside the legitimate library.
Once an application initializes this property, the embedded backdoor quietly executes attacker-controlled code.
Before doing anything malicious, the malware introduces a randomized delay designed to evade security monitoring systems and sandbox analysis.
Only after waiting does the payload begin searching for Digitain-specific backend methods.
If those methods are not found, nothing happens.
If they are detected, the malware proceeds with manipulating the betting platform.
Manipulating Live Betting Results
Researchers found that the primary objective is to compromise Digitain’s FG-Crash online betting game.
Instead of stealing credentials or deploying ransomware, the malware attempts to manipulate crash game outcomes.
Later versions also transmit the manipulated game results to an attacker-controlled server while disguising the traffic as ordinary telemetry.
The exfiltration server reportedly resides at:
185.126.237.64:5341
Communications include a custom HTTP header:
X-Seq-ApiKey: theperfectheist2025
This unusual identifier strongly suggests the operation was carefully planned rather than randomly assembled.
Three Generations Show Continuous Evolution
JFrog researchers identified three major generations of the malware.
The first generation acted primarily as a proof-of-concept capable of manipulating game behavior locally.
The second generation became significantly more sophisticated by introducing remote data exfiltration.
Developers of the malware also employed reflection techniques and ConfuserEx obfuscation to make reverse engineering considerably more difficult.
The third generation focused on improving reliability.
Rigging mechanisms became cleaner, communication stabilized, and exfiltration became more dependable.
Ironically, version 11.0.11 appears completely unobfuscated, suggesting the attacker may have accidentally published an internal development build.
Evidence Suggests Insider Knowledge
Perhaps the most alarming discovery involves the package metadata itself.
Researchers found repeated references to an internal Digitain repository URL across every published version.
This strongly indicates the attacker possessed knowledge of Digitain’s development environment or had access to portions of the company’s source code.
Such evidence raises important questions regarding insider threats, compromised development environments, or unauthorized source code exposure.
Although no definitive attribution has been made, the findings suggest this operation was not created blindly.
Why Most Developers Would Never Notice
One reason this attack remained hidden is its remarkable selectivity.
Developers accidentally installing the package would continue seeing perfectly normal application behavior.
JSON serialization functions correctly.
Applications compile normally.
No credentials are stolen.
No ransomware appears.
No suspicious system modifications occur.
Since the malware activates only under Digitain-specific conditions, almost every accidental victim would assume the package was completely safe.
This level of stealth demonstrates an unusually mature understanding of software supply chain attacks.
Recommended Defensive Measures
Organizations relying on NuGet should immediately verify that no projects reference Newtonsoftt.Json.Net.
Developers should also pin trusted package versions using packages.lock.json to prevent accidental dependency substitution.
Network administrators are advised to block communication with the identified command-and-control infrastructure.
Regular dependency auditing, automated package validation, and cryptographic verification should become standard practice for development teams.
Digitain has acknowledged awareness of the incident and confirmed mitigation measures have already been implemented, although the complete scope of exposure remains unclear.
What Undercode Say:
This incident represents one of the most fascinating examples of a modern software supply chain attack because financial theft was never the immediate objective.
Instead of compromising every machine possible, the attackers invested significant effort into creating precision malware.
That dramatically changes how defenders should think about package repository threats.
Traditional malware generally values volume.
This campaign valued accuracy.
The attackers accepted thousands of harmless installations simply to eventually reach one desired environment.
That patience indicates planning.
The delayed execution further reduces behavioral detection opportunities.
Most endpoint detection platforms look for immediate malicious actions.
Sleeping for randomized periods can bypass automated analysis.
The use of a fully functional legitimate library also minimizes developer suspicion.
Many organizations verify only whether software functions correctly.
Very few inspect every dependency internally.
This attack demonstrates why software integrity cannot be judged by functionality alone.
Another remarkable observation is the absence of credential theft.
No ransomware.
No privilege escalation.
No persistence mechanisms.
The malware remained intentionally minimal.
That simplicity reduced forensic indicators.
The internal repository references deserve particular attention.
Whether obtained through insider access, leaked repositories, or compromised infrastructure, they imply reconnaissance occurred long before malware publication.
Future supply chain attacks may increasingly target operational integrity rather than confidential information.
Gaming platforms.
Financial exchanges.
Industrial automation.
Healthcare systems.
Critical infrastructure.
Any environment where manipulating results creates financial gain becomes an attractive target.
Organizations should adopt Software Bill of Materials (SBOM) validation.
Dependency scanning should become continuous rather than periodic.
Code signing verification must be mandatory.
Repository monitoring should include typo detection.
Behavioral sandboxing must observe delayed execution.
Memory integrity validation should complement static analysis.
Developers must manually verify package publishers.
Automated CI/CD security gates should reject suspicious package names.
Zero Trust principles should extend into development pipelines.
Supply chain security is no longer optional.
It has become fundamental to modern software engineering.
Deep Analysis
The following Linux-based techniques can assist security teams investigating similar dependency compromise incidents:
List installed NuGet packages
dotnet list package
Restore dependencies using lock file
dotnet restore –locked-mode
Search for suspicious package names
grep -Ri Newtonsoftt.Json.Net .
Verify package cache
find ~/.nuget/packages -iname "newtonsoft"
Inspect DLL strings
strings Newtonsoft.Json.dll | less
Search for suspicious API keys
strings Newtonsoft.Json.dll | grep ApiKey
Search for attacker infrastructure
strings Newtonsoft.Json.dll | grep 185.126
Calculate SHA256 hashes
sha256sum Newtonsoft.Json.dll
Analyze IL code
ilspycmd Newtonsoft.Json.dll
Monitor outbound connections
sudo ss -tunap
Capture suspicious traffic
sudo tcpdump -i any host 185.126.237.64
Monitor DNS lookups
sudo journalctl -u systemd-resolved
Scan repository history
git log --stat
Search commit history
git grep "DefaultSettings"
Audit project dependencies
dotnet list package –vulnerable
These commands help investigators verify package integrity, inspect compiled assemblies, identify suspicious outbound communications, and audit dependency chains for signs of software supply chain compromise.
✅ JFrog researchers did identify a malicious NuGet package named Newtonsoftt.Json.Net impersonating the legitimate Newtonsoft.Json library.
✅ The malware was designed to target
✅ Researchers reported multiple published package versions, delayed execution techniques, and evidence suggesting familiarity with Digitain’s internal environment, although the complete extent of any operational impact has not been publicly confirmed.
Prediction
(-1) Security researchers will likely uncover more highly targeted supply chain attacks that focus on manipulating business operations instead of stealing data.
Specialized typosquatting campaigns will become more common against niche industries.
Attackers will increasingly hide malicious logic inside fully functional open-source libraries.
Software repositories will introduce stricter verification and publisher validation mechanisms.
Organizations will accelerate adoption of SBOMs, dependency signing, and automated supply chain monitoring.
Gaming, fintech, and critical infrastructure sectors will receive greater attention from attackers seeking to manipulate outcomes rather than simply exfiltrate information.
▶️ Related Video (70% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.linkedin.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
