Reported by 10 outlets

Timeline

1. original reporting

   Graphalgo Malware Hits Terraform and Go Packages in New Supply Chain Attack

   cyberpress.org · 20d ago · September 23rd, 2026

   Security researchers have found Graphalgo-linked malware in two Terraform providers and two Go modules. The campaign extends a threat previously seen in npm packages and uses hidden triggers to keep the malware inactive during ordinary use. Aikido Security says this is the first systematic malware distribution through Terraform providers it has observed. The affected Terraform providers are gocommunity-io/dockerd and kreuzwenker/docker . The second name closely resembles the legitimate kreuzwerker/docker provider. The affected Go modules are gocommunity.io/orderedbtree and gogets.dev/btreex . Aikido advises treating any version of these four packages as an indicator of compromise. Graphalgo Malware Poisons Terraform Go The malicious Terraform providers contain added code in internal/provider/resource_docker_container_funcs.go . It runs only when the SHA-256 hash of two Terraform values, containerName and networkID , matches a hardcoded value. If the check succeeds, the code decrypts files hidden in an archive disguised as import-resource.sqlite3 , then launches a second-stage Go program with a detached go run . command. This narrow trigger may help the package evade testing while targeting a chosen user. Graphalgo Malware Poisons Terraform Go (Source: aikido) The Go modules use different packaging. gocommunity.io/orderedbtree contains the malware in readable form. gogets.dev/btreex hides it in an archive disguised as btreex.sql and activates only when it processes an object w

2. update from reversinglabs.com

   Fake recruiter campaign targets crypto developers with RAT (ReversingLabs)

   reversinglabs.com · 244d ago · February 11th, 2026

   ReversingLabs documented a new branch of a coordinated fake job recruitment campaign targeting JavaScript and Python developers through social channels, delivering a remote access trojan. This is the report Aikido later cites as the first coverage of what became the Graphalgo campaign, seven months before the Terraform and Go packages surfaced.

3. update from reversinglabs.com

   Graphalgo fake recruiter malware campaign respawned (ReversingLabs)

   reversinglabs.com · 187d ago · April 9th, 2026

   ReversingLabs reported the fake recruiter attack against crypto developers had respawned under the name Graphalgo, this time fronted by a registered LLC and using new techniques to hide malware. Aikido's September analysis links the new Terraform and Go payloads back to this campaign through shared smart contract addresses, Telegram addresses, and Slack workspaces.

4. update from checkmarx.com

   npm 'btree' Malware Campaign Affects Millions of Downloads, No Need for Install Script (Checkmarx Zero)

   checkmarx.com · 26d ago · September 17th, 2026

   Checkmarx Zero uncovered an npm campaign built around a malicious indexed-btree package using blockchain-based command and control without needing an install script, with over 2 million weekly downloads affected. This predates the Terraform provider discovery by five days and shows the same btree lineage operating at scale in npm.

5. update from safedep.io

   Why Does an npm Math Library Need an Encrypted Loader? (SafeDep)

   safedep.io · 26d ago · September 18th, 2026

   SafeDep traced an npm math solver package to encrypted code, walking through the loader, the trigger matrix that unlocks it, and the remote access payload with full indicators.

6. update from jfrog.com

   Equation of Compromise: Anatomy of a Live npm Supply-Chain Campaign (JFrog Security Research)

   jfrog.com · 23d ago · September 21st, 2026

   JFrog Security Research dissected a targeted npm campaign hidden in cloned math libraries, where a backdoor activates only for a specific matrix and receives encrypted tasks through an Ethereum Sepolia smart contract and Slack. JFrog also documented a GitHub Actions worker farm used to manufacture hundreds of thousands of downloads, two days before Aikido reported the same infrastructure reaching Terraform and Go.

7. update from aikido.dev

   Graphalgo campaign spreads to Terraform providers and Go Modules (Aikido Security)

   aikido.dev · 21d ago · September 22nd, 2026

   The providers arm only when the SHA-256 hash of containerName and networkID matches a hardcoded value, and the second-stage RAT uses dual C2 over Slack and an Arbitrum Sepolia smart contract; Aikido's telemetry showed 18 unique victim hostnames across 725 plaintext check-ins.

8. update from gbhackers.com

   Graphalgo Malware Uses Malicious Terraform Providers and Go Modules to Deploy RAT

   gbhackers.com · 20d ago · September 23rd, 2026

   A threat actor linked to the ongoing Graphalgo software supply-chain campaign has expanded beyond npm and PyPI, using malicious Terraform providers and Go modules to deliver a targeted Go-based remote access trojan (RAT). The activity is significant because it marks the first observed case of malware being distributed through Terraform providers, placing infrastructure-as-code workflows directly […] The post Graphalgo Malware Uses Malicious Terraform Providers and Go Modules to Deploy RAT appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

9. mentioned by gbhackers.com

   Graphalgo Deploys RAT Through Malicious Terraform Providers and Go Modules https:// gbhackers.com/graphalgo-malw are/ … Graphalgo, a supply-

   gbhackers.com · 20d ago · September 23rd, 2026

10. update from safedep.io

    Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry Indicators extracted from public reporting. Source:

    safedep.io · 20d ago · September 23rd, 2026

    Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry Indicators extracted from public reporting. Source:

    via Mastodon https://safedep.io/mathmain-encrypted-loader/

11. update from securityonline.info

    Learn how to detect malicious Terraform providers. New malicious Terraform providers spread Graphalgo Go malware through typosquatted packag

    securityonline.info · 18d ago · September 25th, 2026

    Learn how to detect malicious Terraform providers. New malicious Terraform providers spread Graphalgo Go malware through typosquatted packag

    via Mastodon http://securityonline.info/malicious-terraform-providers/?utm_source=mastodon&utm_medium=jetpack_social

12. mentioned by meterpreter.org

    Discover how the Graphalgo campaign weaponized the Terraform Registry and Go modules. Learn about this supply chain attack linked to the Laz

    meterpreter.org · 18d ago · September 25th, 2026

13. update from checkmarx.com

    :terminal: Malicious npm Package indexed-btree hide its Loader in Runtime Code before Removal. A malicious npm package named "indexed-btree"

    checkmarx.com · 8d ago · October 5th, 2026

    :terminal: Malicious npm Package indexed-btree hide its Loader in Runtime Code before Removal.