Affected Systems

HashiCorp Terraform Registry and Go module repositories. Specific malicious packages: gocommunity-io/dockerd (222 downloads), kreuzwenker/docker (1,449 downloads), gocommunity.io/orderedbtree, gogets.dev/btreex. Related npm packages also identified. Targets developers via fake job interviews and coding tasks.

Exploitation Status

Active exploitation confirmed. Campaign attributed to North Korean (DPRK) threat actors, linked to Graphalgo operation first documented February 2026. Multiple malicious packages actively distributed across Terraform Registry, Go modules, and npm. Social engineering via LinkedIn, Facebook, and fake Web3 job postings used as initial access vector.

Business Impact

First known supply chain attack using HashiCorp Terraform Registry as distribution vector. Developers using affected Terraform providers or Go modules are compromised with sophisticated malware featuring dual C2 channels (Ethereum Sepolia testnet smart contract and Slack API). Malware collects system information, hardware attributes, OS details, and hostname. Execution sometimes gated by cryptographic operations, indicating targeted activity. Direct risk to production credentials and infrastructure-as-code environments. Download counts artificially inflated via GitHub Actions to appear legitimate.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit Terraform configurations and Go dependencies for malicious packages: gocommunity-io/dockerd, kreuzwenker/docker, gocommunity.io/orderedbtree, gogets.dev/btreex, and related npm packages (indexed-btree, mathsbase, mathmain, math-universe, modern-events, quick-events, crypto-hasher, events-router, sort-btree, graphcore-js, graphlib-js)
  • Block network connections to Ethereum Sepolia and Arbitrum Sepolia testnets at firewall level; monitor for Slack API conversations.history endpoint polling every 10 seconds
  • Review recent developer onboarding and coding test activities, especially those involving external GitHub repositories or Web3-related companies contacted via LinkedIn or Facebook
  • Implement HashiCorp Terraform provider verification and restrict usage to trusted, verified providers only; enable dependency scanning in CI/CD pipelines
  • Hunt for indicators: ephemeral key pair generation, blockchain smart contract queries to hard-coded Ethereum addresses, outbound Slack API traffic with system enumeration data (hardware, OS, hostname, node availability)