Single-Letter Go Module Typosquat Introduces Persistent Backdoor

A malicious Go module named github.com/shopsprint/decimal has been discovered, impersonating the legitimate github.com/shopspring/decimal library. This typosquatting attack has been active since 2017 and was weaponized in August 2023, allowing attackers to deploy a persistent backdoor. The legitimate package is widely used, with over 38,000 known downloads, affecting numerous Go developers and applications reliant on high-precision arithmetic. Security researchers have confirmed the ongoing risk posed by this malicious package, which could compromise sensitive data and systems. Developers are urged to verify their dependencies to prevent exploitation. The current status of the threat remains active, with no immediate resolution reported.

Key Points: • A malicious Go module has impersonated a widely used library since 2017. • The attack was weaponized in August 2023, introducing a persistent backdoor. • Developers are advised to check their dependencies to mitigate risks.