Cybercriminals have been targeting Go developers through sophisticated typosquatting campaigns that deliver malware loaders and ransomware, often by copying legitimate repositories and enhancing their credibility with fake stars and user engagement.
These attacks involve creating packages with names similar to popular Go modules, then injecting malicious code at runtime to compromise developer systems and potentially infiltrate supply chains.
The campaigns have evolved to include advanced social engineering techniques, such as creating fake GitHub profiles and manipulating repository metrics to appear more trustworthy to unsuspecting developers.
A week before Socket’s report, Mads Hougesen noticed that a jqfmt clone had gained 99 stars in a single day from accounts created only weeks before, and that its main.go quietly fetched the same second stage.
Security researchers documented additional ransomware campaigns and developers shared experiences of repository impersonation attacks with extensive lists of affected repositories.
