Security researchers have identified malicious Terraform providers and Go modules hosted through HashiCorp and Go package ecosystems that were designed to deliver a Go-based implant. The discovery is notable because it appears to be one of the first reported cases of malicious Terraform providers being used as a software supply-chain distribution channel.
Aikido said the affected entries included Terraform providers identified as gocommunity-io/dockerd and kreuzwenker/docker, along with Go modules named gocommunity.io/orderedbtree and gogets.dev/btreex. Researchers said the code overlaps with activity previously tracked as Graphalgo, a campaign that other researchers have associated with suspected North Korean operators.
Command channels and targeted behavior
According to the analysis, the Go malware uses two command-and-control paths: blockchain-based dead drops and Slack APIs. After collecting host details such as hardware information, operating system data and hostname, the implant reportedly sends an initial check-in to an attacker-controlled Slack channel.
The malware then creates temporary cryptographic keys and retrieves encrypted instructions from a smart contract on the Arbitrum Sepolia test network. Researchers said commands can be executed as Go or JavaScript code. The use of encrypted messages, per-host keys and multiple communications channels may make the activity harder to inspect and disrupt.
Related malicious packages found in the npm ecosystem used similar infrastructure and execution controls. In some cases, payloads were only activated after a particular cryptographic calculation, a condition researchers believe could either narrow victim targeting or complicate automated analysis.
Expansion into infrastructure tooling
Terraform providers can run in environments that manage cloud infrastructure, potentially exposing valuable production credentials and deployment access. Researchers cautioned that the observed packages do not by themselves establish that Terraform registries are broadly being abused, but their appearance alongside another recent campaign involving weaponized Terraform components suggests attackers are exploring the ecosystem.
- Review Terraform provider sources, versions and lock files before deployment.
- Restrict provider installation to approved registries and verified publishers.
- Monitor build and developer systems for unexpected Slack API activity, blockchain RPC requests and unapproved package downloads.
- Use dependency scanning and provenance checks for Go, npm, PyPI and infrastructure-as-code packages.