The Hacker News

Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor

A fake Go module posing as golang.org/x/crypto captures terminal passwords, installs SSH persistence, and delivers the ...

Supply chain worm with its own MCP server spreads via GitHub

A new malware is circulating in the npm ecosystem, stealing credentials and CI secrets and spreading autonomously.
ZDNet

GitHub boosts supply chain security for Go modules

GitHub has announced a slew of supply chain security upgrades for modules based on the Go programming language. On July 22, GitHub staff product manager William Bartholomew said in a blog post that Go ...
TechRadar

Dangerous Linux wiper malware hidden within Go modules on GitHub

Three Golang modules on GitHub were found containing dangerous malware The malware was designed to wipe the entire disk of a Linux server It was removed from the platform Dangerous Linux malware, ...
Dark Reading

10 Major GitHub Risk Vectors Hidden in Plain Sight

Risk vector: Package managers like npm, pip, Maven, and Go modules all enable pulling dependencies directly from GitHub repositories instead of official registries. Related:Chinese Police Use ChatGPT ...
Bleeping Computer

Linux wiper malware hidden in malicious Go modules on GitHub

A supply-chain attack targets Linux servers with disk-wiping malware hidden in Golang modules published on GitHub. The campaign was detected last month and relied on three malicious Go modules that ...