Malicious Go Package Exploits Software Supply Chain Vulnerabilities
/ 1 min read
🐍🔗 Malicious Go package exploits software supply chain vulnerabilities. Cybersecurity researchers have identified a supply chain attack targeting the Go ecosystem, involving a malicious package named github.com/boltdb-go/bolt, which is a typosquat of the legitimate BoltDB module. This backdoored version, published in November 2021, allows attackers to gain remote access to infected systems and execute arbitrary commands. The malicious package was cached indefinitely by the Go Module Mirror service, enabling its persistent distribution even after the original repository was modified to remove malicious content. Experts warn that this incident highlights the risks associated with immutable modules and the need for developers to monitor cached versions to prevent similar attacks.
