Cybersecurity experts have identified an unusual NuGet package that deceptively rigs online game results on the Digitain platform. This package, titled “Newtonsoftt.Json.Net,” mimics the popular Newtonsoft.Json library and comes as a trojanized version. Released across seven versions, it has amassed approximately 1,200 downloads from the NuGet repository.
Background on the Trojanized Package
Masquerading as a legitimate JSON library, this package has been removed from search visibility by its creator, MagicalPuff96, yet remains downloadable. It specifically targets Digitain by rigging games and exfiltrating manipulated results to a rogue server using a unique header, according to JFrog researchers.
The package’s distribution includes versions 11.0.4 through 11.0.11, each containing the same trojanized core. The attack initiates when the host system sets JsonConvert.DefaultSettings, exploiting specific backend methods of the targeted entity.
Technical Details of the Attack
The malicious activity is triggered via a modified DefaultSettings property, designed to delay activation and evade detection. The primary goal is to compromise Digitain’s crash-game backend, sending rigged results to a designated IP address, disguised as regular telemetry data.
Throughout its iterations, the package evolved from a local proof of concept to a fully-fledged exfiltration tool, with varying degrees of obfuscation employed across versions. Notably, the final version, 11.0.11, lacks obfuscation, suggesting an accidental clean build release.
Impact and Response
Digitain, the sole target, operates the FG-Crash betting game, with evidence suggesting the attacker had access to internal repositories. The trojan activates only under specific conditions, thus not affecting most developers who unwittingly installed the package.
To mitigate the threat, it is advised to uninstall the package, block associated command-and-control addresses, and secure the Newtonsoft.Json library to trusted versions. Digitain has acknowledged the breach and is implementing corrective measures, though the full impact remains uncertain.
In conclusion, this incident underscores the risks associated with software supply chains, highlighting the importance of vigilance and proactive security practices in the face of evolving cyber threats.
