Trojanized Software Package Put Digitain Crash Games at Risk
JFrog discovered the malicious code within Newtonsoftt.Json.Net, which is a NuGet package that resembles the popular Newtonsoft.Json library. The additional “t” was hard to notice.
Package Mimicked a Common .NET Library
The package had seven different versions from August 13 until October 10, 2025. The seven versions had recorded about 1,200 downloads by the time the package was publicly reported. The package performed like a functioning JSON tool for most of the developers. The malicious code ran only in an environment that exposed a specific method in Digitain’s FG-Crash backend.
The malware also delayed activation, reducing the chance that it would be detected during startup or routine testing.
Attack Targeted Game Integrity
When activated, the trojan used runtime patching to replace the game’s calculated result with a manipulated value. Later versions were designed to send each altered result to an external server. This way, whoever controlled that channel could learn the manipulated results before they were shown to players.
The researchers discovered an address of an internal Digitain repository in the package metadata. The code referenced the exact backend method used to generate game results. According to JFrog, this kind of specificity implies access to the private source code.
The attacker may have been an insider or someone with access to Digitain’s internal repository. Their identity remains unknown, and this theory has not been confirmed.
The malicious code was tailored for one use only. According to JFrog, there were no functions for stealing credentials, persistence, or spreading into other systems. The apparent purpose was to compromise the integrity of one crash game.
Digitain Says the Issue Was Resolved
JFrog reached out to Digitain on July 7, 2026. Two days later, the supplier said it was already aware of the matter and that it had been resolved.
Digitain’s response confirms that the company said it had addressed the issue, but it does not establish the scale of the incident. No financial losses, affected operators, or player-level consequences were disclosed in JFrog’s report.
At the time of JFrog’s report, the package no longer appeared in NuGet search results, although its files remained available for direct download.
Supplier Controls Face a Tougher Test
The case exposes a weak point in B2B gaming. Operators may monitor payouts and certify finished games while relying on software dependencies buried inside a supplier’s build process. Game integrity checks now need to cover package names, locked dependencies, outbound connections, and unusual round patterns. Until live deployment is confirmed, this should be treated as a credible attempted manipulation rather than a proven player-loss event.