Single-Letter Go Module Typosquat Drops DNS-Based Backdoor

A newly uncovered software supply chain attack targeting Go developers demonstrates how a single-character typo can silently introduce a persistent backdoor.

A malicious Go module, github.com/shopsprint/decimal, designed to impersonate the widely trusted github.com/shopspring/decimal library used for high-precision arithmetic in financial and analytics applications.

The legitimate package is heavily adopted across the Go ecosystem, with more than 38,000 known importers.

Its popularity made it an attractive target for typosquatting, where attackers rely on minor spelling differences to trick developers into importing a malicious dependency.

In this case, the substitution of the final letter “g” with “t” creates a nearly indistinguishable module path that compiles and behaves as expected.

The malicious package was first published in November 2017 and remained benign for several years. It mirrored the legitimate library’s source code and release cadence, creating the appearance of a maintained fork.

This changed on August 19, 2023, when version v1.3.3 was released with a hidden payload. Notably, a clean version (v1.3.2) was published just minutes earlier, reinforcing trust before introducing the malicious update, a tactic known as the “trust-then-poison” pattern.

The weaponized version includes a covert backdoor implemented through a Go init() function. Because init() executes automatically when the package is imported, no explicit call is required to trigger the malicious behavior.

Socket’s Threat Research Team identified a malicious Go module published as github.com/shopsprint/decimal Once active, the code launches a background goroutine that continuously polls a command-and-control server via DNS TXT record queries every five minutes.

The typosquatted module github.com/shopsprint/decimal preserves the entire public API and source body of shopspring/decimal.

The domain used for command delivery, dnslog-cdn-images.freemyip.com, is hosted on a free dynamic DNS provider. Instead of using traditional HTTP-based communication, the malware leverages DNS TXT records to receive commands.

Single-Letter Go Module Typosquat

Each TXT response is treated as a system command and executed directly using Go’s os/exec functionality. This method allows attackers to bypass many network monitoring tools, as DNS traffic is often less scrutinized.

Phishing pages impersonating PayPal, Sberbank, and MetaMask, a cluster of DGA-tagged hosts, and persistent C2 nodes with detection counts as high as 14 across the AV stack. 

Although the GitHub repository access and associated user account have been removed, the threat persists due to Go’s module caching system.

Importantly, the malicious logic operates independently of the library’s arithmetic functionality. The package continues to perform all expected calculations correctly, making detection difficult.

There are no visible errors, logs, or behavioral anomalies from an application perspective, while the backdoor runs silently in the background.

The official Go Module Proxy (proxy.golang.org) retains and serves cached versions of all published modules indefinitely.

As a result, the compromised v1.3.3 version remains accessible and can still be fetched by developers today without warning. The package also continues to appear on pkg.go.dev, further increasing exposure risk.

This persistence model has been exploited in previous supply chain attacks and poses a long-term risk, especially for organizations that rely on automated dependency management or fail to verify module sources carefully.

The impact of this backdoor is significant. Any system that built or executed code importing the malicious version effectively granted attackers remote command execution capabilities.

The level of access depends on the privileges of the affected process, which could include developer environments, CI/CD pipelines, or production systems. Sensitive credentials such as API keys, SSH keys, and deployment tokens may be exposed.

Security experts recommend that developers immediately audit their projects for references to the malicious module path and replace it with the legitimate dependency.

Systems that previously used the compromised version should be treated as potentially breached, with credentials rotated and environments rebuilt from trusted sources.

This incident highlights the growing sophistication of supply chain attacks and the importance of strict dependency verification. Even a single-character typo can introduce a long-lived and stealthy compromise into otherwise secure development workflows.

Indicators of Compromise (IOCs)

Malicious Package

github.com/shopsprint/decimal (v1.3.3)

• Malicious commit hash: 2f0ee073c6f29d66188a845592029c9b52528f04

Files

v1.3.3 module zip

• SHA-256: dd9c0268c8944e6ddf90d4d0c81aa843785b7a9ee965faa635841ed9fc0ba086

decimal.go

• SHA-256: 387d7ea5ca733b1e7219c943f4b461877a8df0148adfef42b1538b6c398fbb41
• SHA1: fd26f4ca4746ee390e22043a5e19ebf2b7fcd1f9
• MD5: e3c6ce0440d9acd0f1cef1f0da3cdb5d

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.