Malicious Go Modules Deliver Disk-Wiping Linux Malware in Advanced Supply Chain Attack

Syndicated from the fediverse. Read and engage on the original instance.

Packages:

github.com/truthfulpharm/prototransform

github.com/blankloggia/go-mcp

github.com/steelpoor/tlsproxy

7 replies

There's a reason why there's only privileged write access to /dev/sda.

If you run unknown software as root on any computer you get to experience first hand the impact of: "fuck around and find out".

I mean, you can destroy users' data by doing the equivalent of:

find "$HOME" -type f -delete

No idea why they decided to write to /dev/* directly.

Can't delete a drive that I haven't mounted! :catch_me_if_you_can_vibes:

But if I haven't mounted it, why is it connected in the first place? idk

Uh oh

Ain't no way mah C++ modules deliver any of them malware.

::: spoiler because C++ got no fancy-shmancy modules, got ya! :::

Incorrect. 20 doesssss

pelya reply