malicious-go-module

Typosquatting and malicious Go modules published to pkg.g...

How malicious Go modules exploit pkg.go.dev's open publishing model, real typosquatting attacks like steelpoor/tlsproxy, and why Go's module proxy makes cleanup so hard.