Hidden backdoor in Go package remained undetected for years

Go, a popular programming language prioritizing memory safety and security, was exploited in a supply chain attack through the Google proxy service, affecting the boltdb package. The malicious module contained a backdoor payload, allowing threat actors to control infected systems through a hidden IP and port address. Despite facing resistance, security company Socket Inc. played a crucial role in getting the malicious package removed from Google’s Go Module Mirror.

Full Article