Researchers just found something new, and it's not the malware itself that's interesting, it's where it was hiding, because a Go-based implant has been distributed through two Go Modules and two Terraform providers, and that marks the first time anyone has caught threat actors using HashiCorp's centralized registry as a distribution vector.

Aikido published the finding, and the packages in question are gocommunity-io/dockerd with 222 downloads, kreuzwenker/docker with 1,449 downloads, gocommunity.io/orderedbtree, and gogets.dev/btreex, so four packages in total, split across two different ecosystems.

And the malware behind them isn't new either, because it overlaps with Graphalgo, a campaign ReversingLabs documented back in February and attributed to North Korean threat actors, so this looks less like a fresh operation and more like the same crew trying a new delivery route.

Quick Summary

The Playbook Hasn't Changed

What makes this campaign recognizable is the recruitment angle, because the operators approach developers on LinkedIn and Facebook, or through job postings on forums, while posing as Web3 companies that don't actually exist.

Then they hand over a coding task, the repository looks clean, the work seems legitimate, and the malicious behavior only arrives through a dependency published on npm or PyPI, so the developer never sees the payload in the code they're reviewing.

It's the same social engineering pattern we've seen before, just with a new place to hide the payload.

The npm Side of the Same Operation

The Terraform discovery landed the same week as a new batch of malicious npm packages delivering the exact same threat, flagged by Checkmarx, JFrog, and SafeDep, and the list includes names like indexed-btree, mathsbase, mathmain, math-universe, modern-events, quick-events, crypto-hasher, events-router, sort-btree, graphcore-js, and graphlib-js.

What's notable is how narrow the trigger is, because in some cases the malware only executes when the victim performs a specific cryptographic operation, which is not how broad spray-and-pray supply chain attacks usually work.

JFrog described it well, saying the payload decrypts only when the victim solves a linear system with one specific matrix, takes orders from a smart contract on the Ethereum Sepolia testnet, keeps a second command channel open over Slack, and hides behind download counts manufactured by a farm of GitHub Actions workers.

So the download numbers are fake, the trigger is conditional, and the whole thing is built to look ordinary until it isn't.

What Happens After Infection

The implant contacts a Slack channel and polls the conversations.history endpoint every 10 seconds, then decides what to do based on the packet type it receives, which can be a start packet to begin a file transfer, a chunk packet to supply file content, or an end packet to join the chunks together.

The blockchain path does something similar, it decrypts remote data, writes a file called subwatcher, and starts it with Node.js, so an operator can deliver code for execution on a host where the setup succeeds.

SafeDep was honest about the limits here, saying they recovered the implant but not the later code delivered through those channels, which means we still don't know what tasks an operator actually ran on a victim.

That's an important gap, because the payload's exact functions remain unknown since it's encrypted with asymmetric cryptography.

The Go Port and Its Dual Channels

Aikido said the malware spread through the Terraform providers and Go Modules is a Go port that shares blockchain and Slack infrastructure with the npm version, and it features dual command-and-control channels, using blockchain dead drops and a Slack bot token.

It starts by collecting system information, including hardware attributes, operating system, hostname, and whether the node is available, then sends all of that to the attacker-controlled Slack channel through the API.

Then it does something clever, because the malware generates an ephemeral public-private key pair, combines its ephemeral key with two threat actor public keys to create shared keys, and uses those shared keys to talk to infected clients without exposing the C2 channel or leaking messages between hosts.

The blockchain side pulls data from an Ethereum smart contract on the Arbitrum Sepolia testnet using a hard-coded contract address, polls for encrypted commands every three seconds, and executes them as either Go or JavaScript code.

Oliver Smith from Aikido noted that the threat actor's ability to issue commands is bottlenecked, because all clients consume all messages and simply no-op when they fail to decrypt messages meant for someone else, which is actually a sophisticated design choice that limits leakage at the cost of throughput.

Graphalgo Keeps Its Shape

Socket researcher Karlo Zanki told The Hacker News that Graphalgo continues to follow the same playbook, likely using fake job interviews as the primary initial access vector, and that execution is gated by a basic check for data likely supplied by the front-end component.

Zanki said this behavior could suggest narrowly targeted activity, but it's more likely intended to hinder analysis if researchers find the backend payload without the matching front end, and he noted the original Graphalgo operation showed the same characteristic.

So the conditional trigger isn't a sign of precision targeting, it's a sign of anti-analysis design.

Is Terraform Registry the Next Big Vector

Aikido called the Terraform provider angle a novel tactic, but also one that's perhaps unsurprising, because the registry can provide a more direct pathway to critical production credentials than npm or PyPI typically do.

It's not the first time North Korean actors have used Terraform providers either, because SentinelOne reported last week that a cluster called TraderTraitor relied on weaponized Terraform lock files to deliver Rust-based backdoors from custom Terraform provider registries under their control.

Zanki was careful not to overstate it, saying it's too early to conclude with confidence that DPRK-linked actors are using Terraform registries as a new distribution tactic, but noting that their appearance in two separate campaigns makes coincidence less likely, and that these actors have a history of introducing new infection techniques and reusing what works.

He added that DPRK-linked actors are highly adaptive and continually expand their toolsets, so Terraform registries may represent the next distribution channel they adopt at scale.

The GHAPPIER Loader and PolinRider

CloudSEK also highlighted a previously unreported JavaScript loader called GHAPPIER, distributed after attackers compromised a legitimate npm package named @dforge-core/dforge-mcp, and how they got into the maintainer's account isn't clear, though a malicious extension or package on the developer's machine is suspected.

The loader fetches code from an operator-controlled server and runs it, which lets the threat actor change payloads at runtime, and the malicious version 0.2.21 stayed live on npm for 35 minutes and 38 seconds on September 9, 2026, before the original maintainer reverted it and published a clean 0.2.22.

The same loader has shown up in 65 public repositories belonging to 22 distinct accounts, and CloudSEK researcher Vikas Kundu said it reached them the same way each time, because the operator obtained a developer's stored credentials and used them to write into every repository that developer could push to.

Comparing two copies of the loader, one from the npm package and one from a second victim's repository, showed the same staging host and the same Vercel request, but different campaign tags, ghappier in one and g0115 in the other.

The second payload also used the NullReceiver technique to pull its C2 address, 193.247.144[.]38, from an attacker wallet, and carried the same trailing byte sequence that decodes to "helloipbot!!", which ties this activity to PolinRider, a long-running North Korea-linked campaign.

Rust Warns About Fake Job Interviews

The Rust project also issued a warning about an ongoing campaign targeting rust-lang members and owners of popular crates, with the goal of compromising their devices and accounts for malware distribution.

Adam Harvey from the Rust Foundation described the pattern, saying a video call is set up for something positive, maybe a job, maybe a project, maybe a contract opportunity, and then it's used to get the target to install something like a supposedly missing audio codec, or to execute a command placed on the clipboard.

He added that the attackers set up new but legitimate-seeming company profiles, including plausible LinkedIn presences, to pass cursory inspection, and the Rust project said the playbook overlaps with the Contagious Interview campaign tied to North Korea.

Their advice is straightforward, enable multi-factor authentication, check accounts for unexpected logins, and be careful with anyone who wants you to install something during a call.

The Bottom Line

Terraform providers are now a malware distribution vector, and it's the same North Korean operation that's been running fake job interviews and compromised developer accounts for months, so the platforms keep changing while the playbook stays the same, which means the defense is less about watching one registry and more about watching the behavior, like unexpected dependency changes, conditional triggers, and packages whose download counts don't match their actual reputation.

Quick Reference

What to Do

• Enable MFA on all developer accounts
• Check accounts for unexpected logins
• Review dependencies for conditional triggers
• Watch download counts that look manufactured
• Be cautious with job interviews that require installs

FAQ Section

What is the Terraform provider malware campaign?

It is a DPRK-linked operation that distributed Go-based malware through two Go Modules and two Terraform providers, marking the first known use of HashiCorp's registry as a distribution vector.

Which packages were involved?

Aikido listed gocommunity-io/dockerd, kreuzwenker/docker, gocommunity.io/orderedbtree, and gogets.dev/btreex.

How does the malware communicate?

It uses dual command-and-control channels, pulling encrypted commands from Ethereum and Arbitrum smart contracts while also polling a Slack channel for file transfer instructions.

What is Graphalgo?

It is a campaign first documented by ReversingLabs in February and attributed to North Korean actors, and this new activity overlaps with it in tooling and infrastructure.

What is GHAPPIER?

It is a JavaScript loader distributed after attackers compromised the npm package @dforge-core/dforge-mcp, and it has appeared in 65 repositories across 22 accounts.

What should developers do?

Enable MFA, check accounts for unexpected logins, review dependencies for conditional triggers, and be careful with job interviews that ask you to install software.

Source: The Hacker News