Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of...

GraphAlgo Scam: Lazarus Hackers Register Real US LLCs to Spread Malware

ReversingLabs has discovered a fresh wave of the graphalgo campaign in which North Korean Lazarus hackers are using fake Florida LLCs, mimicking SWFT Blockchain, and using GitHub typo-squatting to target developers with malware...

Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems

Cybersecurity researchers have discovered a fresh set of malicious packages across npm and the Python Package Index PyPI repository linked to a fake recruitment-themed campaign orchestrated by the North Korea-linked Lazarus Group. The coordinated campaign has been codenamed graphalgo in reference...

Malicious code in graphalgo (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-6514 Malicious code in graphalgo (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3687 Malicious code in graphalgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5d170316b7d69234c298baf1d1364ae3207e2f0774c87782a648d4c492920bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in graphalgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5d170316b7d69234c298baf1d1364ae3207e2f0774c87782a648d4c492920bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...