Fake Terraform Providers on HashiCorp Registry Distribute Go Malware to Developers

Cybersecurity researchers have identified Go-based malware distributed through two fake Terraform providers and two Go modules hosted on the official HashiCorp registry. This marks the first documented case of malicious code being delivered via the HashiCorp registry, providing attackers with a direct path to production credentials.

The malicious providers are gocommunity-io/dockerd, which has recorded 222 downloads, and kreuzwenker/docker, which has 1,449 downloads. The corresponding modules are gocommunity.io/orderedbtree and gogets.dev/btreex. All four packages closely imitate names of legitimate projects.

The attack does not originate from the registry itself. Operators instead contact developers on LinkedIn, Facebook, and employment forums using fabricated Web3 company profiles. They deliver repositories that appear harmless, with the malicious behavior introduced through dependencies hosted on npm or PyPI.

Once executed, the malware gathers hardware attributes, operating system details, hostname, and node availability, then transmits this data to attacker-controlled infrastructure before waiting for further instructions.

Command and Control Infrastructure

The command-and-control system uses two separate channels. One channel queries a Slack channel every ten seconds for packages that initiate, feed, and terminate file transfers. The second channel reads encrypted commands from smart contracts on the Sepolia testnet of Ethereum every three seconds and executes them as either Go or JavaScript code.

Each infected client generates an ephemeral key pair that is combined with the operator’s public key, ensuring that a compromised machine cannot decrypt messages intended for other victims.

The malware code matches the Graphalgo campaign, which was documented by ReversingLabs in February 2026 and attributed to North Korean actors in April.