Malware Infects Linux and macOS via Typosquatted Go Packages

Socket exposes a typosquatting campaign delivering malware to Linux and macOS systems via malicious Go packages. Discover the tactics used, including obfuscation and domain typosquatting, and learn how to stay safe.

Cybersecurity researchers at software supply chain security solutions provider, Socket, have uncovered a concerning new trend where malicious actors are increasingly targeting developers within the Go programming language network.

By employing a technique known as typosquatting, these attackers distribute malware disguised as legitimate Go packages, which are designed to install hidden malware loaders on Linux and macOS systems.

Socket’s investigation, shared with Hackread.com, shows that the attackers have published at least seven of these deceptive packages on the Go Module Mirror, a central repository for Go modules. The full list includes:

• github.com/vainreboot/layout
• github.com/utilizedsun/layout
• github.com/thankfulmai/hypert
• github.com/shallowmulti/hypert
• github.com/ornatedoctrin/layout
• github.com/shadowybulk/hypert
• github.com ...