go-mal-pkgs

go-mal-pkgs A security tool to detect malicious Go packages by verifying checksums in go.sum against the original source code, bypassing the Go Module Proxy cache. Overview This tool helps protect against supply chain attacks that exploit the Go Module Proxy cache, as recently demonstrated by the...

UBUNTU-CVE-2026-56865

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

The vulnerabilities of the GOMODPROXY and GOSUMDB modules in the Go programming language allow attackers to circumvent security restrictions and gain access to read and modify data.

The vulnerability of GOMODPROXY and GOSUMDB modules written in the Go programming language is related to improper verification of the cryptographic signature. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain access to read and modify data...