Listen to this Post
Introduction: Open
Cybercriminals are increasingly exploiting open-source ecosystems to inject malicious code into unsuspecting developer environments. A recent revelation by cybersecurity researchers has uncovered a wave of 11 dangerous Go packages and 2 npm libraries—all crafted to silently hijack systems, exfiltrate sensitive data, and even remotely wipe files based on phone number-based triggers.
What makes this attack especially concerning is its cross-platform adaptability, stealthy behavior, and deep infiltration into popular repositories like GitHub and npm. These malicious packages don’t just infect one machine—they exploit developer trust and software supply chains, threatening countless downstream users.
Inside the Malicious Code: the Original Report
Cybersecurity specialists have flagged 11 malicious Go packages engineered to deliver a second-stage payload that infects both Windows and Linux systems. At runtime, the code executes silently—spawning a shell, contacting command-and-control (C2) servers hosted on .icu and .tech domains, and then executing malicious scripts in memory.
These packages, such as github.com/stripedconsu/linker and github.com/expertsandba/opt, use obfuscated loaders to pull down ELF and PE binaries. These binaries can extract host info, access browser data, and beacon back to the attacker. Due to the decentralized Go ecosystem, malicious packages masquerade under trustworthy names, confusing developers during searches on pkg.go.dev.
The attack vector targets both Linux and Windows: for Linux, the payload delivers a bash script; for Windows, it uses certutil.exe to download executable files.
Security researcher Olivia Brown explains the broader threat: the Go ecosystem’s flexibility allows GitHub imports directly, making it easy for attackers to slip malicious modules into legitimate-seeming projects.
Further analysis suggests these packages originate from a single threat actor, based on reused infrastructure and coding patterns. This discovery also dovetails with the emergence of two npm packages—naya-flore and nvlore-hsc—which appear to mimic WhatsApp socket libraries but contain a hidden kill switch.
These npm packages, downloaded over 1,110 times, connect to a GitHub repository to fetch an Indonesian phone number database. If the executing system’s number isn’t found, the package executes a recursive delete command (rm -rf), effectively wiping the device post a WhatsApp pairing check.
Security researcher Kush Pandya also discovered that naya-flore includes a hardcoded GitHub Personal Access Token, hinting at unauthorized access to private repositories. Though unused in the current version, it suggests future plans for even more sophisticated attacks.
Experts at Fortinet FortiGuard Labs emphasize that attackers are evolving their tactics subtly—opting for low file counts, stealthy installation scripts, and increasing obfuscation. As open-source software (OSS) continues to expand, so does the attack surface for these sophisticated supply chain threats.
💡 What Undercode Say:
Deep Dive: The Hidden Danger Behind Go & npm Modules
Undercode analysts point out that this situation highlights the critical vulnerabilities in open-source ecosystems, especially for languages like Go that allow direct GitHub imports without central verification. Here’s our technical breakdown:
1.
The Go module system, while efficient, is inherently risky. With modules often fetched directly from GitHub, there’s no real validation layer. This allows attackers to craft malicious modules with names resembling legitimate libraries, making it dangerously easy for developers to fall into the trap.
2. Stealth Execution Techniques
The malware doesn’t write files to disk—it operates entirely in memory, using bash scripts or certutil.exe for stealthy second-stage execution. This fileless approach evades most traditional antivirus solutions, giving attackers prolonged access without detection.
3. Social Engineering via npm
The two npm packages weaponize social engineering by pretending to be WhatsApp-related libraries. Developers integrating them unknowingly trigger malware that can completely wipe their systems unless their number is “whitelisted.”
4. Supply Chain Targeting
This isn’t just about compromising individual users. These packages infiltrate build servers, developer workstations, and entire CI/CD pipelines. One compromised package can lead to mass-scale downstream infections.
5. Reconnaissance & Exfiltration Potential
The second-stage payloads have the capability to collect host data, access web browser content, and send it to remote servers. This signals data theft, user surveillance, and potential credential harvesting, especially from browser-stored sessions.
6. Cryptocurrency & Wallet Targeting
Although not directly confirmed in this batch, previous similar attacks show that attackers often embed routines to steal crypto wallet data. Given the stealth and sophistication, it’s highly plausible such features could be included in future iterations.
7. Obfuscation Levels Are Increasing
Code obfuscation is no longer amateurish. These packages use complex loader chains, encoded strings, and conditional payload execution, making reverse-engineering harder and analysis slower.
8. Lack of Central Auditing Tools
Neither Go nor npm currently enforces strict auditing, signature verification, or review for submitted packages. This leaves room for impersonation, namespace abuse, and long-term persistence of malware.
✅ Fact Checker Results:
All identified malicious packages are actively tracked by security researchers.
The attack method, including .icu and .tech C2 domains, has been independently confirmed by multiple sources.
The npm-based kill switch logic using rm -rf has been verified in code analysis.
🔮 Prediction: The Next Wave of Attacks Is Already Coming
Expect a surge in fake developer tools, libraries, and SDKs disguised under trusted-sounding names. Attackers will increasingly target supply chains rather than individuals, and GitHub will become a major battleground for module-based infections. The presence of hardcoded tokens and undeclared features suggests that next-gen malware packages are already in development, with more destructive capabilities and better camouflage.
Developers, build engineers, and DevSecOps professionals must adopt zero-trust models, utilize automated static analysis tools, and continuously audit dependencies—especially in open-source environments.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: thehackernews.com
Extra Source Hub:
https://stackoverflow.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
