Malicious Terraform Providers and Go Modules Found on HashiCorp Registry Delivering Go-Based Malware

What Happened

Researchers at Aikido have disclosed a campaign distributing Go-based malware through two malicious Go Modules and two Terraform providers published to the HashiCorp Registry. According to the report, this marks the first documented case of threat actors using HashiCorp's centralized registry as a distribution vector for malicious payloads. Named packages include gocommunity-io/dockerd (222 downloads) and kreuzwenker/ (name truncated in the source reporting), among others identified by Aikido.

Why It Matters for Defenders

Terraform providers and Go modules are pulled automatically by infrastructure-as-code and CI/CD pipelines, often with elevated credentials for cloud provisioning. A malicious provider or module in this supply chain can execute during routine terraform init or go get operations, giving attackers a foothold with the same trust and permissions as legitimate infrastructure tooling. Organizations using community or lesser-known Terraform providers and Go modules — particularly in automated pipelines with limited manual review — are at risk. The download counts reported are modest, suggesting a narrow but real blast radius so far.

What Defenders Should Watch For

• Inventory Terraform providers and Go module dependencies in use across IaC repositories and CI/CD pipelines; flag any from unverified or low-reputation publishers.
• Review required_providers blocks and go.sum/go.mod files for unexpected or unfamiliar entries, especially recently added ones.
• Monitor CI/CD runner and build-agent egress and process activity for anomalous outbound connections or binary execution following terraform init or go build/go get steps.
• Pin provider and module versions with checksums, and restrict pipeline credentials to least privilege to limit impact if a malicious dependency executes.
• Cross-reference the specific package names and download counts noted by Aikido against your own dependency manifests.

Developing Story

This is a net-new supply-chain disclosure and details — including the full list of affected packages, attacker infrastructure, and intended payload behavior — may evolve as researchers continue investigating. For the full technical writeup, see the original report from The Hacker News.