Graphalgo malware spreads from npm to Terraform providers and Go modules

Past-week coverage · Original source published 2026-10-21.

The malware campaign that ReversingLabs first reported in February, which targeted JavaScript and Python developers with cryptocurrency-themed fake recruiter tasks, has moved into Terraform providers and Go modules, according to research published by Aikido and summarized by ReversingLabs.

Aikido researcher Oliver Smith wrote in a September post that the activity overlaps with the Graphalgo npm campaign. The Terraform version is written in Go and shares blockchain and Slack infrastructure and a public key with recent npm samples. Smith also found at least two fake package ecosystems, gogets[.]dev and gocommunity[.]io, set up to make the packages look legitimate. Aikido described the activity as small and targeted rather than a mass infection.

The operators published two Terraform providers, gocommunity-io/dockerd and kreuzwenker/docker. The second namespace is one letter off from a Docker provider engineers know, which reportedly has 56 million downloads.

Analysts quoted by ReversingLabs said the shift matters because Terraform users often hold cloud access and production credentials. The malware reportedly stays dormant until a specific hash condition is met and acts only on messages meant for a given victim, with command-and-control over Slack and an Ethereum smart contract.

Defensive advice from those analysts: route provider installs through an internal mirror of approved providers, keep build runners off the public registry, and check every new provider source address in a lock file diff character by character.