{"id":1806,"date":"2025-02-06T13:25:08","date_gmt":"2025-02-06T13:25:08","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=1806"},"modified":"2025-02-06T13:25:08","modified_gmt":"2025-02-06T13:25:08","slug":"malicious-package-found-in-the-go-ecosystem","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=1806","title":{"rendered":"Malicious package found in the Go ecosystem"},"content":{"rendered":"<div>\n<div class=\"grid grid--cols-10@md grid--cols-8@lg article-column\">\n<div class=\"col-12 col-10@md col-6@lg col-start-3@lg\">\n<div class=\"article-column__content\">\n<div class=\"container\"><\/div>\n<p>A malicious typosquat package has been found in the\u00a0<a href=\"https:\/\/www.infoworld.com\/article\/2253031\/whats-the-go-language-really-good-for-3.html\">Go language<\/a>\u00a0ecosystem. The package, which contains a backdoor to enable remote code execution, was discovered by researchers at the application security company Socket.<\/p>\n<p>A February 3\u00a0<a href=\"https:\/\/socket.dev\/blog\/malicious-package-exploits-go-module-proxy-caching-for-persistence\">Socket blog post<\/a>\u00a0states that the package impersonates the widely used\u00a0<a href=\"https:\/\/socket.dev\/go\/package\/github.com\/boltdb\/bolt\">Bolt database module<\/a>. The BoltDB package is widely adopted in the Go ecosystem, with\u00a0<a href=\"https:\/\/pkg.go.dev\/github.com\/boltdb\/bolt\">8,367 packages<\/a>\u00a0dependent on it, according to the blog. After the malware was cached by the Go Module Mirror, the\u00a0git\u00a0tag was strategically altered on GitHub to remove traces of malware and hide it from manual review. Developers who manually audited\u00a0github.com\/boltdb-go\/bolt\u00a0on GitHub did not find traces of malicious code. But downloading the package via the Go Module Proxy retrieved an original backdoored version. This deception went undetected for more than three years, allowing the malicious package to persist in the public repository.<\/p>\n<p><a href=\"https:\/\/www.infoworld.com\/article\/3817921\/malicious-package-found-in-the-go-ecosystem.html\">Continue reading on InfoWorld.<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>A malicious typosquat package has been found in the\u00a0Go language\u00a0ecosystem. The package, which contains a backdoor to enable remote code execution, was discovered by researchers at the application security company Socket. A February 3\u00a0Socket blog post\u00a0states that the package impersonates the widely used\u00a0Bolt database module. The BoltDB package is widely adopted in the Go ecosystem, [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":1807,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-1806","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/1806"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1806"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/1806\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/1807"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1806"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1806"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1806"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}