Cybersecurity
Malicious Terraform providers deliver Go malware
Aikido said four packages in HashiCorp’s registry carried Go malware that overlapped with Graphalgo, while other disclosures in npm and Rust-related activity described similar lures and command channels.
- Aikido said Go malware had been spread through two Terraform providers and two Go modules in HashiCorp's registry.
- The packages were gocommunity-io/dockerd, kreuzwenker/docker, gocommunity.io/orderedbtree and gogets.dev/btreex, and the code overlapped with Graphalgo.
- Researchers said the attack chain used benign code tasks, package registries, Slack, and blockchain commands, and that some payloads only activated after a specific cryptographic check.
- CloudSEK said a compromised npm package briefly carried a loader called GHAPPIER, and the Rust project warned about interview lures aimed at developers.
Aikido said Go malware had been distributed through two Terraform providers and two Go modules in HashiCorp's registry. It named gocommunity-io/dockerd, kreuzwenker/docker, gocommunity.io/orderedbtree and gogets.dev/btreex, and said the code overlapped with Graphalgo.
The article said developers had been approached through social platforms or job offers and then steered towards benign code that pulled in malicious dependencies. It added that the same campaign also used package registries and a chain that could hide behind specific execution conditions.
JFrog said the payload only decrypted after a particular cryptographic step, while SafeDep said the implant used Slack for one command path and blockchain smart contracts for another. Oliver Smith said the malware created temporary keys and combined them with threat-actor keys before talking to infected hosts.
The article also said GitHub Actions workers had been used to inflate download counts. CloudSEK separately said @dforge-core/dforge-mcp had briefly shipped version 0.2.21 with GHAPPIER on 9 September 2026, and that the loader later appeared in 65 public repositories across 22 accounts.
The Rust project warned that fake interview calls and plausible company profiles were being used to push software onto developers' machines or to get them to run commands.
Named in this story
People
- Oliver Smith
- described the malware’s key-generation scheme
Companies
- Aikido
- said Go malware had been spread through registry packages
- HashiCorp
- hosted the registry used in the distribution path
- Checkmarx
- flagged a separate set of malicious npm packages
- JFrog
- analysed the payload and its activation conditions
- SafeDep
- recovered the implant and described its channels
- CloudSEK
- reported a compromised npm package carrying a loader
Organisations
- Rust project
- warned about interview lures aimed at developers
Products and systems
- gocommunity-io/dockerd
- one malicious Terraform provider
- kreuzwenker/docker
- one malicious Terraform provider
- gocommunity.io/orderedbtree
- one malicious Go module
- gogets.dev/btreex
- one malicious Go module
- Graphalgo
- the earlier campaign the malware overlapped with
- npm
- one package registry used in related malicious distribution
- GitHub Actions
- used to manufacture download counts in one claim
- Slack
- served as a command channel
- @dforge-core/dforge-mcp
- the legitimate npm package that was compromised
- GHAPPIER
- the JavaScript loader distributed through the compromise
Places
- Ethereum Sepolia testnet
- provided one blockchain source for commands
- Arbitrum Sepolia testnet
- provided another blockchain source for commands
How the source tells it
The source read like a brisk security roundup, with strong novelty and urgency cues and repeated threat framing.
- novelty a first-time claim and a question-style subhead framed registry abuse as a new channel
- urgency recent timing cues such as latest and this week linked the separate findings
- alarm repeated malware language and North Korea-linked attribution kept the threat level high