Malicious Terraform Providers Deliver Go Malware Through HashiCorp Registry

Security researchers have identified two malicious Terraform providers and two Go modules distributing Go-based malware through HashiCorp Registry and Go package infrastructure. Aikido named the affected Terraform providers as gocommunity-io/dockerd, downloaded 222 times, and kreuzwenker/docker, downloaded 1,449 times. The related Go modules are gocommunity.io/orderedbtree and gogets.dev/btreex.

The finding marks the first reported use of HashiCorp's centralized registry as a delivery channel for malicious payloads. Aikido said the malware is a Go port that overlaps with the Graphalgo campaign, which ReversingLabs documented in February and attributed to North Korean, or DPRK, threat actors.

Shared Slack and blockchain command infrastructure

The Go implant collects system information at launch, including hardware attributes, the operating system, hostname, and whether Node.js is available. It sends the captured information to an attacker-controlled Slack channel through the API.

After checking in, the malware creates an ephemeral public-private key pair. Researcher Oliver Smith said it combines that key with two threat-actor public keys to generate shared keys, allowing communication with infected clients over shared channels without exposing command-and-control traffic or messages between hosts.

Its second command channel is a blockchain dead drop. The malware queries a hard-coded smart contract on the Arbitrum Sepolia testnet every three seconds for encrypted commands. It can execute received commands as Go or JavaScript code. Aikido said all clients consume all messages, but only act when they can decrypt a message intended for them, limiting the operator's ability to issue commands at scale.

Campaign expands beyond npm and PyPI

Graphalgo has used a familiar social-engineering path: prospective developers are approached on LinkedIn, Facebook, or job forums by purported Web3 companies and asked to complete a coding task. A benign GitHub repository can then acquire malicious behaviour through a dependency published on npm or PyPI.

Researchers recently identified additional npm packages carrying the same malware. JFrog reported that some variants activate only when a specific cryptographic operation is performed, retrieve instructions through an Ethereum Sepolia smart contract, and retain a Slack-based channel. The later payload remains unknown because it is encrypted with asymmetric cryptography.

Terraform is significant because providers can offer a route towards critical production credentials. SentinelOne also reported a separate TraderTraitor activity cluster using weaponized Terraform lock files and attacker-controlled custom provider registries to deliver Rust backdoors. Karlo Zanki of Socket said it is too early to conclude that Terraform registries are an established DPRK distribution tactic, although their appearance in two campaigns makes coincidence less likely.

What security teams should do

The incident reinforces the need to treat infrastructure dependencies as executable supply-chain risk. Businesses should review Terraform provider provenance and versions, restrict projects to approved registries and providers, investigate unexpected dependency additions, and ensure that credentials accessible to deployment tooling are tightly scoped. Teams should also brief developers on fraudulent recruitment approaches, because a seemingly routine coding task may be the entry point for a poisoned dependency.