Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads.

According to Aikido, the list of Terraform providers and Go modules is as follows:

The malware deployed through these packages demonstrates overlaps with Graphalgo, a campaign first documented by ReversingLabs in February and attributed to North Korean (aka DPRK) threat actors.

As part of this effort, prospective developers are approached via social platforms like LinkedIn and Facebook, or through job offerings on forums, by posing as non-existent Web3 companies. Targets are then asked to complete a coding task via a benign GitHub repository that introduces malicious behavior through a dependency published on npm or PyPI.

Malicious npm Packages Delivering the Same Threat

The latest discovery coincides with the identification earlier this week of a new batch of malicious npm packages delivering the exact same threat. A list of flagged packages, as highlighted by Checkmarx, JFrog, and SafeDep, includes:

  • indexed-btree
  • mathsbase
  • mathmain
  • math-universe
  • modern-events
  • quick-events
  • crypto-hasher
  • events-router
  • sort-btree
  • graphcore-js
  • graphlib-js

An analysis of these packages shows that, in some cases, malware execution is triggered only when a specific cryptographic operation is performed, exhibiting all hallmarks of a targeted operation.

“The payload decrypts only when the victim solves a linear system with one specific matrix, takes its orders from a smart contract on the Ethereum Sepolia testnet, keeps a second command channel open over Slack, and hides behind download counts manufactured by a farm of GitHub Actions workers,” JFrog said.

Dual C2 Channels: Blockchain and Slack

The attack chain delivers an encrypted payload whose exact functions remain unknown due to asymmetric cryptography. The implant is designed to contact a Slack channel and polls the conversations.history endpoint every 10 seconds, performing the next action based on the packet type:

  • Start packet — to begin a file transfer
  • Chunk packet — to supply file content
  • End packet — to join the chunks

“The blockchain path also decrypts remote data, writes subwatcher, and starts it with Node.js,” SafeDep said. “These paths let an operator deliver code for execution on a host where the required setup succeeds. We recovered the implant, but not the later code delivered through these channels. We therefore cannot say what tasks an operator ran on a victim.”

Aikido said the malware distributed through the Terraform providers and Go Modules is a Go port that shares blockchain and Slack infrastructure with the npm version, featuring dual command-and-control (C2) channels using blockchain dead drops and a Slack bot token.

At the outset, the malware collects system information including hardware attributes, operating system, hostname, and whether a Node.js runtime is available on the infected system. The captured data is then transmitted to the attacker-controlled Slack channel via the API.

“Following the check-in call, the malware generates an ephemeral public-private key pair,” security researcher Oliver Smith said. “The malware generates shared keys by combining its ephemeral key with two threat actor public keys. The shared key allows the malware to communicate with infected clients using shared channels without exposing C2 communications or leaking messages between infected hosts.”

The blockchain-based C2 retrieves data from an Ethereum smart contract on the Arbitrum Sepolia testnet using a hard-coded contract address, polling for encrypted commands every three seconds. The commands are then executed as either Go or JavaScript code.

“The C2 mechanism is further indication that this malware is part of a targeted operation,” Smith said. “The threat actor’s ability to issue commands is bottlenecked because all clients consume all messages and no-op when they fail to decrypt messages intended for other clients.”

“This is a notably sophisticated implementation of a blockchain dead drop that integrates bidirectional communication with minimal risk of information leakage or disruption.”

Socket security researcher Karlo Zanki told The Hacker News that Graphalgo continues to follow the same operational playbook, likely using fake job interviews as the primary initial access vector.

“Execution is gated by a basic check for data likely supplied by the front-end component,” Zanki said. “Although this behavior could suggest narrowly targeted activity, it is more likely intended to hinder analysis if researchers discover the backend payload without the corresponding front end. The original Graphalgo operation exhibited the same characteristic.”

Is Terraform Registry the New Supply Chain Attack Vector?

The appearance of Terraform providers as a distribution mechanism is a novel tactic, but one that is perhaps unsurprising given that it can provide a more direct pathway to critical production credentials, Aikido noted. It also illustrates the threat actor expanding the campaign’s reach beyond npm and PyPI.

This is not the first time North Korean adversaries have used Terraform providers for malware distribution. In a report published last week, SentinelOne detailed how the threat activity cluster codenamed TraderTraitor relied on weaponized Terraform lock files to deliver Rust-based backdoors from custom Terraform provider registries under their control.

“It is too early to conclude with confidence that DPRK-linked threat actors are using Terraform registries as a new distribution tactic,” Zanki said. “Nevertheless, their recent appearance in two separate campaigns associated with these operators makes coincidence less likely. These threat actors have a history of introducing new infection techniques and applying successful methods across multiple campaigns.”

“DPRK-linked threat actors are highly adaptive and continually expand their toolsets with techniques that can reach a broad range of targets. Terraform registries may represent the next distribution channel they adopt at scale.”

The development also comes as CloudSEK highlighted a previously unreported JavaScript loader named GHAPPIER that was distributed following the compromise of a legitimate npm package, @dforge-core/dforge-mcp. It is currently not known how the attackers gained access to the maintainer’s account, though researchers suspect the developer’s machine may have been infected by a malicious extension or package.

The primary objective of the loader is to fetch code from an operator-controlled server and execute it, allowing the threat actor to dynamically alter payloads at runtime.

The malicious version (0.2.21) remained live on npm for 35 minutes and 38 seconds on September 9, 2026, before the original maintainer reverted the changes and published a clean version (0.2.22). The same loader has since been observed in 65 public repositories belonging to 22 distinct accounts, underscoring the breadth of the campaign’s reach across the open-source ecosystem.