News Summary

A critical security issue was uncovered in the Go Module Mirror, a service run by Google to cache open source packages for the Go programming language. For over three years, the mirror hosted a backdoored version of a widely used module due to a typosquatting attack. The malicious module, named ‘boltdb-go/bolt’, was a variation of the legitimate ‘boltdb/bolt’ that 8,367 other packages depend on. This attack leveraged the caching design of the Go Module Proxy service, enabling persistent distribution of the malicious code, despite subsequent modifications to the original GitHub repository.