Graphalgo malware reaches Terraform providers and Go modules

On 22 September 2026 Aikido Security published research on four packages that carry a Go port of the Graphalgo malware: two Terraform providers on the HashiCorp registry and two Go modules. Press coverage on 23 September described it as the first reported use of the Terraform Registry to distribute malware. Socket's Karlo Zanki, quoted by The Hacker News, said it is too early to conclude that attackers are adopting Terraform registries at scale.

This matters beyond four package names. Terraform providers are native binaries that run during plan and apply, with whatever cloud credentials the Terraform process holds.

What happened

Aikido names these packages:

• Terraform providers gocommunity-io/dockerd and kreuzwenker/docker. The second is a one letter typosquat of kreuzwerker/docker, which Aikido says has 56 million reported downloads.
• Go modules gocommunity.io/orderedbtree and gogets.dev/btreex.

Aikido says gocommunity.io/orderedbtree was first published on 11 August and gogets.dev/btreex on 8 September, with commits forged to look like November 2025. The providers were published in early September.

According to Aikido, the providers hide an entry point in resource_docker_container_funcs.go. It only fires when the SHA256 of two input values, the container name and network ID, matches a specific hash. That hash doubles as an AES key to decrypt a file path. The malware unzips an archive, decrypts the files and runs them with a detached go run .. The btreex module triggers on a specific integer value instead, and its payload is hidden in a ZIP disguised as a SQL file. The orderedbtree module has the malware in plaintext.

Conditional triggers like these are built to survive casual review and sandboxes. They also mean that installing the package is not the same as running the malware, though you should not rely on that.

The command and control

Aikido describes a second stage remote access tool with two channels. Check-in goes to a Slack workspace through the Slack API, and a separate channel reads commands from a smart contract on the Arbitrum Sepolia testnet, polled every 3 seconds. The check-in reports platform, hostname, username and home directory. Commands can run more Go or JavaScript code or delete the malware.

Aikido's scale figures, which are its own observations:

• 725 plaintext check-in messages from 18 unique hostnames (3 Windows, 5 Linux, 10 macOS).
• 1,240 encrypted messages in one Slack channel since 16 July.
• 1,402 contract transactions since 6 August.

Aikido says the operation looks small and targeted and that it does not have enough information to notify victims.

Attribution and what is reported

Aikido ties the Go code to the JavaScript and npm Graphalgo samples through shared infrastructure and a shared public key. Graphalgo was first documented by ReversingLabs in February 2026, and The Hacker News says it was attributed to North Korean actors. Treat the attribution as reported, not proven here. Socket says fake job interviews are the likely main way developers get lured, using a coding task that pulls in a malicious dependency.

Other firms reported related npm packages that same week, and The Hacker News lists download counts for the two providers (222 and 1,449). Aikido's post gives no counts, so those two figures are second hand.

What is unknown

• Which versions are affected. Aikido treats any version of the four names as malicious.
• The final payload. Researchers quoted by The Hacker News said they recovered the implant but not the later code.
• Whether the registries have removed everything. Aikido's post does not say, and coverage conflicted on the Go proxy. Check both directly.

What to do now

1. Search your Terraform lock files and go.mod and go.sum files, and CI caches, for the four names above. Also check for kreuzwenker, with the n.
2. If any host or runner installed one, isolate it from the network, since it may still reach the operator through Slack or the blockchain.
3. Reimage the host. Deleting the package does not stop processes it launched.
4. Rotate everything that touched that machine: Git, package publish, SSH and cloud credentials. For Terraform exposure, start with cloud and infrastructure credentials.
5. Review commits, package publishes, Terraform applies and CI runs from the exposure window.

How this could have been avoided

• Pin providers with a committed .terraform.lock.hcl and review any change to it as a code change. A new provider source address in a lock file is a signal.
• Allow only an approved list of provider namespaces in CI, for example hashicorp, your own, and named vendors. A typosquat of kreuzwerker fails that check.
• Run plan and apply with short lived, least privilege credentials, so a provider that runs hostile code gets little.
• Restrict outbound traffic from CI runners. Reaching api.slack.com and blockchain endpoints is rarely needed for infrastructure builds, and Aikido suggests alerting on HTTP based blockchain traffic where there is no business need.
• Treat unsolicited coding tests from recruiters as untrusted code, and run them in a throwaway environment.

Try it yourself

Pick one provider or module you use and compare its exact name to the publisher you expect. Then try the typosquat demo to see how a one letter difference slips through.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Aikido: Graphalgo in Terraform providers and Go modules (22 Sep 2026, updated 24 Sep)
• The Hacker News: Attackers use malicious Terraform providers to deliver Go malware (23 Sep 2026)