MAL-2026-17454 Malicious code in gogets.dev/btreex (Go)

Part of the Graphalgo campaign. The module, first published around 2026-09-08, hides its payload in a ZIP archive disguised as a SQL file btreex.sql. The payload is triggered when a specific price integer value is passed, and drops the same dual-channel RAT Ethereum smart contract dead drop plus...

MAL-2026-17453 Malicious code in gocommunity.io/orderedbtree (Go)

Part of the Graphalgo campaign. The module, first published around 2026-08-11, contains a second-stage remote access trojan in plaintext that runs automatically. The RAT collects system information, executes decrypted Go or JavaScript payloads, and polls two command-and-control channels every 3-1...

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of...

GraphAlgo Scam: Lazarus Hackers Register Real US LLCs to Spread Malware

ReversingLabs has discovered a fresh wave of the graphalgo campaign in which North Korean Lazarus hackers are using fake Florida LLCs, mimicking SWFT Blockchain, and using GitHub typo-squatting to target developers with malware...

Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems

Cybersecurity researchers have discovered a fresh set of malicious packages across npm and the Python Package Index PyPI repository linked to a fake recruitment-themed campaign orchestrated by the North Korea-linked Lazarus Group. The coordinated campaign has been codenamed graphalgo in reference...

Malicious code in graphalgo (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-6514 Malicious code in graphalgo (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in graphalgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5d170316b7d69234c298baf1d1364ae3207e2f0774c87782a648d4c492920bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3687 Malicious code in graphalgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5d170316b7d69234c298baf1d1364ae3207e2f0774c87782a648d4c492920bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in graphalgo

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...