Malicious Terraform Providers and Go Modules Used to Distribute Graphalgo Malware
Cybersecurity researchers have uncovered malicious Go-based malware distributed through two Go Modules and two Terraform providers, marking a new use of the centralized HashiCorp Terraform Registry as a distribution channel for malicious software.
According to security researchers at Aikido, the following Terraform providers and Go modules were identified:
- gocommunity-io/dockerd: 222 downloads
- kreuzwenker/docker: 1,449 downloads
- gocommunity.io/orderedbtree
- gogets.dev/btreex
The malware found in these packages shares characteristics with Graphalgo, a campaign previously linked to North Korean threat actors.
Graphalgo Campaign Targets Developers
Graphalgo has previously targeted developers through fake job opportunities and coding assignments.
Threat actors approach potential victims through platforms such as LinkedIn and Facebook, as well as job forums, while posing as representatives of fake Web3 companies.
Victims are then asked to complete coding tasks using apparently legitimate GitHub repositories. Malicious dependencies hidden within npm or PyPI packages are used to introduce malware into the developer's environment.
The latest discovery indicates that the attackers are expanding beyond npm and PyPI and are now using Terraform providers and Go Modules.
Malware Uses Blockchain and Slack for C2
The malware distributed through the Terraform providers and Go Modules is a Go-based variant that shares infrastructure with the previously observed Graphalgo malware.
It uses two command-and-control channels:
- Blockchain-based communication
- Slack-based communication
The malware first collects information about the infected system, including:
- Hardware details
- Operating system information
- Hostname
- Node availability
The collected information is then transmitted to an attacker-controlled Slack channel.
After checking in with the attacker, the malware generates a temporary public and private key pair.
It then derives shared keys using the generated key and two attacker-controlled public keys. This mechanism allows infected systems to communicate through shared channels while helping separate communications between different victims.
Ethereum Smart Contract Used for Commands
The malware also uses a smart contract on the Arbitrum Sepolia testnet as a blockchain-based command channel.
It communicates with a hard-coded Ethereum smart contract address and checks for encrypted commands approximately every three seconds.
Commands retrieved through the blockchain channel can be executed as either:
- Go code
- JavaScript code
Researchers described the mechanism as a blockchain dead drop that allows attackers to communicate with infected systems without maintaining a traditional C2 server.
The malware also uses Slack as a secondary communication channel and polls the Slack conversations.history API approximately every 10 seconds.
Researchers observed different packet types used for file transfers:
- Start packet: begins a file transfer
- Chunk packet: transfers file content
- End packet: combines the transferred chunks
The exact second-stage payload delivered through these channels remains unknown.
Malicious npm Packages Linked to the Same Campaign
The discovery comes shortly after researchers identified additional malicious npm packages associated with the same malware ecosystem.
Some of the packages include:
indexed-btreemathsbasemathmainmath-universemodern-eventsquick-eventscrypto-hasherevents-routersort-btreegraphcore-jsgraphlib-js
Researchers found that some of these packages only activate their malicious functionality when a particular cryptographic operation is performed.
This behavior can make the malware more difficult to analyze because the payload does not necessarily execute immediately after installation.
According to researchers, the malware can also retrieve commands through an Ethereum smart contract and maintain a second communication channel through Slack.
Terraform Registry Becomes a New Supply Chain Concern
The use of Terraform providers represents a significant expansion of the campaign's distribution methods.
Terraform providers are commonly used by developers and infrastructure teams to automate cloud and infrastructure deployments. Malicious providers could therefore potentially gain access to development environments containing sensitive credentials and infrastructure information.
Researchers said the appearance of Terraform providers suggests that threat actors are looking beyond traditional package ecosystems such as npm and PyPI.
However, researchers cautioned that it is still too early to determine whether Terraform registries are becoming a large-scale distribution method for North Korea-linked malware campaigns.
Another Malicious npm Supply Chain Campaign
Separately, CloudSEK researchers identified a JavaScript loader named GHAPPIER distributed through a compromised npm package called @dforge-core/dforge-mcp.
The malicious version, 0.2.21, was available on npm for approximately 35 minutes on September 9, 2026, before the legitimate maintainer released version 0.2.22.
The loader was also found in 65 public repositories belonging to 22 different accounts.
Researchers believe attackers obtained stored developer credentials and used them to modify repositories accessible through those accounts.
The loader connects to attacker-controlled infrastructure and can retrieve additional code for execution.
Researchers also observed similarities between the campaign and the North Korea-linked PolinRider activity.
Rust Developers Also Targeted Through Fake Job Offers
The developments come alongside a warning from the Rust project about attacks targeting Rust developers and maintainers of popular crates.
Attackers have reportedly used fake job interviews, project opportunities, and contract offers to convince developers to install malicious software or execute commands.
In some cases, attackers allegedly create convincing company profiles and LinkedIn accounts to make fraudulent job opportunities appear legitimate.
The Rust project said the activity shares similarities with the Contagious Interview campaign, which has previously been linked to North Korean threat actors.
Developers and open-source maintainers are advised to enable multi-factor authentication, monitor account activity, and carefully verify software, dependencies, and commands received during job interviews or collaboration opportunities.
Key Takeaway
The discovery demonstrates how software supply chain attacks are expanding across multiple developer ecosystems.
Threat actors associated with the Graphalgo campaign have now been observed using npm packages, Go Modules, Terraform providers, blockchain-based command channels, and Slack infrastructure.
Developers and organizations should carefully verify third-party dependencies, monitor package installation activity, review Terraform providers before use, and avoid executing untrusted code received through job interviews or online coding assignments.
