Packages:
- github.com/truthfulpharm/prototransform
- github.com/blankloggia/go-mcp
- github.com/steelpoor/tlsproxy
Malicious Go Modules Deliver Disk-Wiping Linux Malware in Advanced Supply Chain Attack
https://thehackernews.com/2025/05/malicious-go-modules-deliver-disk.html
15 Comments
HelloRoot@lemy.lol · 77 pts · 1y
Aaah finally, malware for Linux, truly the year of the Linux Desktop!
Ahrotahntee@lemmy.ca · 33 pts · 1y
We made it! I never thought I'd live to see this day!
FriendBesto@lemmy.ml · 1 pts · 1y
Notice me Hacker Senpai!
vegetvs@kbin.earth · 65 pts · 1y
This is absolutely not just specific to Go.
krakenfury@lemmy.sdf.org · 38 pts · 1y
The problem isn't specific to anything. It's also not specific to malware. Vulnerabilities are just as dangerous, if not more so.
FurryMemesAccount@lemmy.blahaj.zone · 7 pts · 1y
Cargo also has a
--gitoption but I suppose it's not default behaviorkrakenfury@lemmy.sdf.org · 2 pts · 1y
Sure! My point is that hosting doesn't really matter, though. Malware and vulnerabilities are introduced at all points of supply chains.
FurryMemesAccount@lemmy.blahaj.zone · 3 pts · 1y
I agree, I was just giving another example to raise awareness about that feature of rust.
fluxion@lemmy.world · 33 pts · 1y
This is why we can't have nice things
UnfortunateShort@lemmy.world · 17 pts · 1y
Any intel on affected, high-profile software?
MoonMelon@lemmy.ml · 15 pts · 1y
I found the original blog post more educational.
Looks like these may be typosquats, or at least "namespace obfuscation", imitating more popular packages. So hopefully not too widespread. I think it's easy to just search for a package name and copy/paste the first .git files, but it's important to look at forks/stars/issue numbers too. Maybe I'm just paranoid but I always creep on the owners of git repos a little before I include their stuff, but I can't say I do that for their includes and those includes etc. Like if this was included in hugo or something huge I would just be fucked.
catloaf@lemm.ee · 10 pts · 1y
The really fun version of that is when people take some of the hallucinated package names from an LLM and create them, but with malware.
dubyakay@lemmy.ca · 0 pts · 1y
termaxima@programming.dev · 6 pts · 1y
tomatoely@sh.itjust.works · 4 pts · 1y
If anyone is curious, I checked the yay aur helper go dependencies here and it had none of the malicious packages mentioned on this post
OctaviaMeowzly@lemmy.blahaj.zone · 1 pts · 1y
Halloween documents pt 2