- Three Golang modules on GitHub were found containing dangerous malware
- Malware was designed to dry the entire disk on a Linux server
- It was removed from the platform
Dangerous Linux Malware capable of bricklayers is found in Golang modules on GitHub, experts say.
Recently, CyberSecurity founders from Socket Three GO modules on GitHub: GitHub[.]com/truthfulpharm/PrototransformGitHub[.]com/blankoggia/GO-MCPand github[.]com/steelpoor/TLSPOXY.
The three mimic legitimate and popular projects: Prototransform (helps convert protobuf -data between different formats), model context protocol (provides encryption and hashish functionalities to AI assistants) and TLS -proxy (a proxy tool that provides encryption to TCP and HTTP servers).
Destroys all disks
All three do the same – as soon as they are activated, they check if they are running in a Linux environment, and then overwrite each byte with data with zeros.
This is essentially masonry, as all the data on it is irrevocably lost. Socket says the disk-wiping code was “very veiled” and triggered as soon as malware is activated and practically does not leave time to respond.
“By filling in the entire disk with zeros, the script completely destroys the file system structure, operating system and all user data, making the system unexplained and not reinforcing,” socket explained.
Bleeping computer Says Go -Ecosystem’s decentralized organization “lacks proper control”, enabling packages from different developers to have the same or similar names. Threat players abuse this model for running typosquatting attacks and fools developers to download the wrong solutions.
As soon as socket discovered malware, the GitHub who removed it notified it from the platform. We do not know how long the modules hosted or how many people may have fallen victim to the attack.
Unfortunately, there is no easy way to defend against these types of attacks. The best course of action is to be careful when downloading code from Open Source stocks, to analyze the developers and their status in the community, reviews and download counts.
Via Bleeping computer
