Typosquatting Go Module Installs DNS Backdoor

Key Takeaways

• A malicious Go module, github.com/shopsprint/decimal, typosquatting the legitimate github.com/shopspring/decimal library, has been discovered.
• The rogue package contains a DNS-based backdoor that establishes a covert command-and-control (C2) channel, executing commands received via DNS TXT records.
• The attack specifically targets Go developers in financial, billing, cryptocurrency, and analytics sectors, impacting any system that imports the compromised v1.3.3 of the module.
• Despite the original GitHub repository being deleted, the malicious module remains permanently accessible via the Go Module Proxy.

Typosquatting Campaign Uncovers Long-Lived Go Module Backdoor

For nearly three years, a subtle typo in a Go module lay dormant, only recently weaponized to deploy a sophisticated DNS backdoor. Security researchers have uncovered a malicious package, github.com/shopsprint/decimal, which closely mimics the widely used github.com/shopspring/decimal library, differing by just a single character in its name.

Initially published in 2017, the package remained benign until August 2023, when attackers surreptitiously introduced a function designed to establish a hidden command-and-control channel using DNS records.

This targeted operation primarily aims at Go developers involved in critical applications such as financial software, billing systems, cryptocurrency platforms, and data analytics tools. These developers frequently rely on the legitimate shopspring/decimal library for precise arithmetic operations, crucial for avoiding rounding errors in sensitive calculations.

The malicious package is crafted with such precision that it mirrors its authentic counterpart almost perfectly. Projects importing the rogue module will compile and run without any overt errors or unusual output, making detection difficult for developers.

Discovery and Weaponization Timeline

Researchers at Socket.dev were instrumental in identifying the malicious module and meticulously tracing its evolution to the point of weaponization. Their findings, shared in a report, highlight that the malicious version, v1.3.3, was published on August 19, 2023. This release occurred a mere seven minutes after a legitimate update, creating a deceptive veneer of routine maintenance. Prior to this, seven earlier versions of the module were entirely harmless, a deliberate tactic to cultivate trust over time before activating the attack.

A critical aspect of this threat is its persistence. Even after the original GitHub account hosting the malicious module was removed, the Go Module Proxy at proxy.golang.org retains a permanent cache of every published module version. This inherent feature of Go’s reproducibility guarantee means that the compromised v1.3.3 remains fully accessible to any developer who executes go get for that specific package path, without any cautionary alerts.

The threat actor maintained a low profile for years, strategically embedding a persistent foothold within various development environments globally. With its beacon firing every five minutes and no detectable process activity, the backdoor could remain undiscovered for weeks or even months on any system that incorporates the compromised package.

The Single-Letter Trap Explained

The entire distinction between the safe and dangerous packages rests on a single character. The authentic library is named shopspring, while the typosquatting version uses shopsprint, substituting the final ‘g’ with a ‘t’. Developers typing quickly, recalling from memory, or relying on autocomplete features could inadvertently import the incorrect module without realizing the error.

The malicious version introduces three new imports into its source file: net, os/exec, and time. The presence of these packages in a decimal math library is highly anomalous and serves as the clearest technical indicator of compromise. The attack payload resides within an init() function, which Go automatically executes at startup before any other code. Consequently, merely importing the typosquatted module anywhere within a project’s dependency tree is sufficient to initiate the command-and-control loop.

DNS-Based Backdoor Mechanism

Upon activation, the malicious init() function initiates a background loop that queries a specific DNS subdomain every five minutes, requesting a TXT record. TXT records are a type of DNS entry designed to hold arbitrary text, which the attacker exploits to deliver operating system commands directly to infected machines. The command server subdomain is identified as dnslog-cdn-images[.]freemyip[.]com, hosted on a free dynamic DNS provider fully controlled by the attacker.

Any command embedded within the TXT record is directly passed to the operating system for execution. The results of these commands are captured and then discarded, leaving no visible output, logs, or other traces that might alert a user or system administrator. This method leverages DNS traffic, which is often less scrutinized than outbound HTTP, allowing the attacker to issue commands while evading detection by many conventional security tools.

What You Should Do

• Immediate Host Compromise Protocol: If any developer or CI system has pulled in version v1.3.3 of github.com/shopsprint/decimal, consider that host compromised. All credentials on that machine, including Git tokens, cloud keys, and SSH keys, must be rotated immediately.
• Audit Go Module Dependencies: Teams should thoroughly audit their Go module files (e.g., go.mod) for any references to github.com/shopsprint/decimal. Replace the malicious package with the legitimate github.com/shopspring/decimal.
• Monitor DNS Traffic: Implement robust monitoring for DNS queries originating from build or production environments to freemyip[.]com. This domain has no legitimate role in standard Go toolchains and its presence indicates potential compromise.
• Review Code Imports: Developers should carefully review import statements, particularly for packages with similar names, to prevent typosquatting attacks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.