Poisoned Pipeline / Incidents / AS185
Malicious Go modules (obfuscated payloads, SSH lure, proxy cache)
Socket: 11 Go packages with obfuscated remote payloads; a module
disguised as an SSH brute-forcer; typosquatted Go loaders; persistence
via Go module proxy caching.
Mapped techniques
supply-chain campaign
Malicious Go modules.
Lookalike module paths.
Remote payloads.
Sources
- https://socket.dev/blog/11-malicious-go-packages-distribute-obfuscated-remote-payloads
- https://socket.dev/blog/malicious-go-module-disguised-as-ssh-brute-forcer-exfiltrates-credentials
- https://socket.dev/blog/typosquatted-go-packages-deliver-malware-loader
- https://socket.dev/blog/malicious-package-exploits-go-module-proxy-caching-for-persistence
- https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns
- https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/