{"id":8284,"date":"2025-03-05T08:11:15","date_gmt":"2025-03-05T08:11:15","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/7-malicious-go-packages-found-on-linux-macos\/"},"modified":"2025-03-05T08:11:16","modified_gmt":"2025-03-05T08:11:16","slug":"7-malicious-go-packages-found-on-linux-macos","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/7-malicious-go-packages-found-on-linux-macos\/","title":{"rendered":"7 Malicious Go Packages Found on Linux &#038; macOS"},"content":{"rendered":"\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Mar 05, 2025<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><\/span><span class=\"p-tags\">Open Source \/ Malware<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEig1iHPYQ5Egu2r7P-gOmvvUUtdQcBor-2dwxs_IAxIWOYKJ8SSvRAHhsoQmyQuurUlY7vPNEzfqNeUYnY0KE5j4H8gso_HWkhRc4LKVJV2UvWRKHmxntVXFe8a6Up9YFBUxT6Hxde8I3FgOfFk1LN2nt-fla2g3FnCcCwncInmpxsU8N0-m0u8IvIeSB74\/s728-rw-e365\/go-malware-packages.png\" style=\"clear: left; display: block; float: left;  text-align: center;\" rel=\"nofollow noopener\" target=\"_blank\"><\/a><\/div>\n<p>Cybersecurity experts have issued a warning about an ongoing malicious campaign targeting the Go ecosystem, where typosquatted modules are being used to deploy loader malware on Linux and Apple macOS systems.<\/p>\n<p>According to Socket researcher Kirill Boychenko, &#8220;the threat actor has published at least seven packages impersonating widely used Go libraries, including one (github[.]com\/shallowmulti\/hypert) that appears to target financial-sector developers,&#8221; as stated in a <a href=\"https:\/\/socket.dev\/blog\/typosquatted-go-packages-deliver-malware-loader\" rel=\"noopener nofollow\" target=\"_blank\">recent report<\/a>.<\/p>\n<p>Boychenko noted that &#8220;these packages share repeated malicious filenames and consistent obfuscation techniques, suggesting a coordinated threat actor capable of pivoting rapidly.&#8221;<\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/cis-securesuite\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><img fetchpriority=\"high\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhsFQaSLfkFdKcodtNnSya8V2yj1C_ZVcqQImhnHDikdLhrgZ4hoAIdzNPEjMn6tIl2dSBa9PZVJm5Q6CW4Iprd32O0xaNt3UTVX1U9kEK629GDLqpr7Dd6lynygeNXdkuKNi_TlVZ1vRZI_fXFdvFwBm25WNf4tQHZfgpXHiaw1nnd6E5jLX8vrn4fB3mN\/s728-e100\/cis-d.png\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>Although all the packages are still available on the official package repository, their corresponding GitHub repositories, with the exception of &#8220;github[.]com\/ornatedoctrin\/layout&#8221;, are no longer accessible. The list of offending Go packages includes:<\/p>\n<ul>\n<li>shallowmulti\/hypert (github.com\/shallowmulti\/hypert)<\/li>\n<li>shadowybulk\/hypert (github.com\/shadowybulk\/hypert)<\/li>\n<li>belatedplanet\/hypert (github.com\/belatedplanet\/hypert)<\/li>\n<li>thankfulmai\/hypert (github.com\/thankfulmai\/hypert)<\/li>\n<li>vainreboot\/layout (github.com\/vainreboot\/layout)<\/li>\n<li>ornatedoctrin\/layout (github.com\/ornatedoctrin\/layout)<\/li>\n<li>utilizedsun\/layout (github.com\/utilizedsun\/layout)<\/li>\n<\/ul>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiSL78asfJxDMd40PcSNXj5fIPrMDqDmbDNfWRZH8kWl-eKUZj3Jn0k8TY2TvrQWaemQdPsGYui9FmHzfmeHSUh37xnoTQfj8Fd7RGXPgfJ3SbbSvTtQOd6FWdxghclkMmPMFWLZBy0X8XBpyjEdh0NOdgXowNsXITCvwhUYiFzmYjE-ONBPioN_rP77MeY\/s728-rw-e365\/go-malware.png\" style=\"clear: left; display: block; float: left;  text-align: center;\" rel=\"nofollow noopener\" target=\"_blank\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiSL78asfJxDMd40PcSNXj5fIPrMDqDmbDNfWRZH8kWl-eKUZj3Jn0k8TY2TvrQWaemQdPsGYui9FmHzfmeHSUh37xnoTQfj8Fd7RGXPgfJ3SbbSvTtQOd6FWdxghclkMmPMFWLZBy0X8XBpyjEdh0NOdgXowNsXITCvwhUYiFzmYjE-ONBPioN_rP77MeY\/s728-rw-e365\/go-malware.png\" alt=\"Seven Malicious Go Packages Found\" border=\"0\" data-original-height=\"538\" data-original-width=\"819\" title=\"Seven Malicious Go Packages Found\"\/><\/a><\/div>\n<p>Socket&#8217;s analysis revealed that the counterfeit packages contain code designed to achieve remote code execution by running an obfuscated shell command to retrieve and run a script hosted on a remote server (&#8220;alturastreet[.]icu&#8221;). The remote script is not fetched until an hour has elapsed, likely in an attempt to evade detection.<\/p>\n<p>The ultimate goal of the attack is to install and run an executable file that can potentially steal data or credentials.<\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/cloud-secure-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><img decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhPWsOsc5-XgG7OgLaedicSgtFyWz34mXvDdyCyBN0HSv2LVBMQPs-Ma8uaYGqN19Mvm7puED6vlOFihpguPFfq-e_PQ6pfqHPeMKSX6luNSqXs_m3IHmaA6waPe8qHtxB35qw_CdmXzEDQ30crRU_-UvN9w8cSL1W51CocP1fJXyJIrdUcBNvSaMyhb_cV\/s728-e100\/cloud-secure-d.jpg\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>This disclosure comes a month after Socket <a href=\"https:\/\/thehackernews.com\/2025\/02\/malicious-go-package-exploits-module.html\" rel=\"noopener nofollow\" target=\"_blank\">revealed<\/a> another instance of a software supply chain attack targeting the Go ecosystem via a malicious package capable of granting the adversary remote access to infected systems.<\/p>\n<p>According to Boychenko, &#8220;the repeated use of identical filenames, array-based string obfuscation, and delayed execution tactics strongly suggests a coordinated adversary who plans to persist and adapt.&#8221;<\/p>\n<p>He further noted, &#8220;the discovery of multiple malicious hypert and layout packages, along with multiple fallback domains, points to an infrastructure designed for longevity, enabling the threat actor to pivot whenever a domain or repository is blacklisted or removed.&#8221;<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Found this article interesting?  Follow us on <a href=\"https:\/\/twitter.com\/thehackersnews\" rel=\"noopener nofollow\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a> and <a href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" rel=\"noopener nofollow\" target=\"_blank\">LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/03\/seven-malicious-go-packages-found.html\" rel=\"nofollow noopener\" target=\"_blank\">Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue802Mar 05, 2025\ue804Ravie LakshmananOpen Source \/ Malware Cybersecurity experts have issued a warning about an ongoing malicious campaign targeting the Go ecosystem, where typosquatted modules are being used to deploy&#8230;<\/p>\n","protected":false},"author":19,"featured_media":8285,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-8284","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/03\/go-malware-packages.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/8284","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=8284"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/8284\/revisions"}],"predecessor-version":[{"id":8286,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/8284\/revisions\/8286"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/8285"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=8284"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=8284"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=8284"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}