Cybersecurity researchers from Aikido, JFrog, Checkmarx, and SafeDep have jointly disclosed a coordinated supply-chain campaign in which North Korean threat actors published two malicious Terraform providers and two Go modules to HashiCorp’s official registry — marking the first documented use of HashiCorp’s centralized registry as a malware distribution channel. The campaign is attributed to the same threat cluster behind Graphalgo, a DPRK-linked operation first documented by ReversingLabs earlier this year that targets software developers through fake job offers on LinkedIn and Facebook, asking them to complete a coding task using a GitHub repository that injects malicious behavior via a registry dependency. The four packages identified in this wave: Terraform providers kreuzwenker/docker (1,449 downloads) and gocommunity-io/dockerd (222 downloads); Go modules gocommunity.io/orderedbtree and gogets.dev/btreex.
The implant is exceptionally evasive. It decrypts its payload only when the victim’s environment solves a linear system with a specific cryptographic matrix, ensuring the malware never activates in sandboxes or on unintended machines. Once triggered, it contacts a smart contract on the Ethereum Sepolia testnet to retrieve a second-stage configuration, polls a Slack conversations.history endpoint every ten seconds for operator commands, and supports three packet types — Start (begin file transfer), Chunk (supply content), and End (assemble the file). The actor also manufactured artificial download counts using a farm of GitHub Actions workers to make the packages appear legitimately popular. Because the full second-stage payload is encrypted with asymmetric keys the researchers could not recover, the complete scope of what the operator could execute on compromised developer machines remains unknown. A parallel wave of malicious npm packages delivering the same malware was identified this week by the same research teams.
How to check if you’re affected
Affected products include any Terraform configuration that imports the kreuzwenker/docker or gocommunity-io/dockerd providers, and any Go project that lists gocommunity.io/orderedbtree or gogets.dev/btreex as a dependency. Run grep -r "kreuzwenker/docker\|gocommunity\|gogets.dev" . in your project roots to check for matches. If you were approached via LinkedIn or a job forum with a coding challenge that involved these dependencies, treat the machine as potentially compromised and rotate all developer credentials and CI/CD secrets immediately. Also audit go.sum and terraform.lock.hcl for unexpected provider or module versions introduced in recent weeks.