Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library

Researchers discovered a NuGet typosquat package ('Newtonsoftt.Json.Net') that trojanizes Newtonsoft.Json to specifically target Digitain's FG-Crash betting backend: it activates when JsonConvert.DefaultSettings is assigned, introduces randomized delays to evade detection, rigs game results, and exfiltrates data to 185.126.237.64:5341 using header X-Seq-ApiKey:theperfectheist2025; seven versions were published (11.0.4–11.0.11), the package was downloaded ~1,200 times, and recommended mitigations include removing the package, blocking the C2, and pinning Newtonsoft.Json to a known-good version.