Poisoned Pipeline / Incidents / AS165

AS165 · 2026-03

Malicious Go crypto module Rekoobe backdoor

Go modules

Socket: malicious Go crypto module steals passwords and deploys Rekoobe backdoor.

Mapped techniques

• T0109 Publish malicious artifact
• T0172 Runtime backdoor
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://socket.dev/blog/malicious-go-crypto-module-steals-passwords-and-deploys-rekoobe-backdoor