For the first time, attackers have used HashiCorp’s public Terraform Registry to distribute malware. Two malicious Terraform providers and two Go modules delivered a Go-based implant that talks to its operators over a blockchain smart contract and a Slack bot, and the campaign links back to Graphalgo, a North Korea-attributed operation first documented in February. The provider counts are small so far, but the vector is the story: if a poisoned dependency can enter through your infrastructure-as-code, it enters with a direct line to your production credentials.
We spend a lot of time on the seam between deployment tooling and live infrastructure, and this is exactly the seam attackers are now probing. A malicious npm package infects a developer laptop. A malicious Terraform provider runs inside the process that provisions your cloud. Those are not the same blast radius.
What was published
Per Aikido, which disclosed the activity, the malicious packages were:
- Terraform providers:
gocommunity-io/dockerd(222 downloads) andkreuzwenker/docker(1,449 downloads). - Go modules:
gocommunity.io/orderedbtreeandgogets.dev/btreex.
Notice the naming. dockerd and docker are typosquat-adjacent names built to look like legitimate container tooling, which is exactly what an engineer wiring up container infrastructure might grab without a second look. Both share infrastructure with a parallel wave of malicious npm packages flagged this week by Checkmarx, JFrog, and SafeDep, including indexed-btree, mathsbase, mathmain, math-universe, modern-events, quick-events, crypto-hasher, events-router, sort-btree, graphcore-js, and graphlib-js. If any of those names are in your dependency tree, treat it as a hit and read the response section below.
Why a Terraform provider is a worse place to hide malware than an npm package
This is the point worth sitting with. Aikido called the Terraform vector novel but unsurprising, and the reasoning is blunt: a provider gives a more direct pathway to critical production credentials. Think about where Terraform code actually runs. It runs in your CI/CD pipeline or on an operator’s machine, holding exactly the credentials needed to create and destroy real infrastructure: cloud API keys, cloud provider tokens, secrets for whatever it provisions. A provider is code that Terraform executes with all of that in reach. Malware that lands there does not need to escalate or move laterally to get to the good stuff. The good stuff is already in the environment it starts in.
This is also not a one-off experiment. Just last week, SentinelOne detailed a separate North Korea-linked cluster, TraderTraitor, using weaponized Terraform lock files to deliver Rust backdoors from attacker-controlled provider registries. Two DPRK-linked campaigns reaching for Terraform in the same window is the kind of pattern that stops being coincidence. As Socket’s researcher put it, these actors have a history of taking a technique that works and applying it across campaigns, and Terraform registries may be the next distribution channel they scale up.
How the implant talks home: two C2 channels, both hard to kill
The Go implant delivered through the Terraform and Go paths is a port that shares blockchain and Slack infrastructure with the npm version, and it runs dual command-and-control. This design is what marks it as a targeted, well-resourced operation rather than commodity crimeware.
On execution it fingerprints the host, collecting hardware attributes, OS, hostname, and whether Node.js is present, then sends that check-in to an attacker Slack channel over the API. From there:
- Slack channel: the implant polls the
conversations.historyendpoint every 10 seconds and reassembles file transfers from a sequence of start, chunk, and end packets. A Slack bot token as C2 blends into normal corporate traffic, because outbound HTTPS to Slack is not something most egress rules flag. - Blockchain dead drop: the Go port pulls encrypted commands from an Ethereum smart contract on the Arbitrum Sepolia testnet, using a hard-coded contract address and polling every 3 seconds. Retrieved commands run as Go or JavaScript. There is no takedown for a smart contract, so this channel cannot simply be seized the way a domain can.
The operators layered real cryptographic discipline on top. The implant generates an ephemeral key pair and derives shared keys by combining it with two threat-actor public keys, so infected hosts can share channels without exposing C2 traffic or leaking one victim’s messages to another. Every client consumes every message and silently no-ops on anything it cannot decrypt. Researchers recovered the implant but not the later code delivered through these channels, which means the full set of actions run on victims is still unknown. Read that as a warning, not an all-clear: “we could not recover the second-stage payload” is not “there was no second stage.”
How victims get hit in the first place
The delivery relies on social engineering as much as on the registry. The Graphalgo playbook approaches developers through LinkedIn, Facebook, and job-board postings, posing as Web3 companies that do not exist, then asks the target to complete a coding task built around a benign-looking GitHub repo that pulls in the malicious dependency. In several packages the payload only decrypts when the victim performs a specific cryptographic operation, solving a linear system with one particular matrix, which both narrows execution to intended targets and frustrates researchers who find the backend without the matching front end.
This same fake-interview pattern is spreading. The Rust project warned this month about an ongoing campaign targeting rust-lang members and popular crate owners, where a video call for a supposed job or contract is used to get the target to install something (a fake “missing audio codec”) or paste a command from the clipboard. The Rust warning overlaps with the Contagious Interview campaign, also tied to North Korea. The common thread across all of it: the initial access is a person being convinced to run code, and the package registry is just the delivery mechanism.
What to do
There is no single patch here, because the exposure is a class of dependency, not a versioned bug. Concrete steps:
- Audit your Terraform providers and modules against the named list. If
gocommunity-io/dockerd,kreuzwenker/docker,gocommunity.io/orderedbtree, orgogets.dev/btreexappear anywhere in your IaC, treat the environment that ran them as compromised. - Check your npm tree for the flagged packages listed above, since they share the same operator infrastructure.
- Rotate every credential the affected pipeline or machine could reach. For Terraform that means cloud API keys, provider tokens, and any secret the plan had access to. Given the whole point of the Terraform vector is proximity to production credentials, assume those are the first thing that was taken.
- Watch egress for the C2 patterns. Unexpected outbound calls to Slack API endpoints from a build agent, or any traffic to Arbitrum Sepolia testnet RPC endpoints from infrastructure that has no business touching a blockchain, are strong signals. Normal build servers do not poll
conversations.historyevery 10 seconds. If you are not sure your team would catch that pattern, an outside penetration test of the pipeline is a faster way to find out than waiting for an incident. - Pin and vet infrastructure dependencies like production code. Providers and modules from unfamiliar namespaces deserve the same scrutiny as any third-party package, and low download counts on a provider with a name that mimics popular tooling is a red flag, not a reassurance.
- Treat unsolicited job interviews that involve running code as hostile. If a “hiring task” or a call asks a developer to clone and run a repo, install a codec, or paste a command, that is the initial access vector in this entire campaign family. Enforce MFA and review accounts for unexpected logins. If you suspect a machine already ran one of these payloads, that is exactly the scenario our emergency malware removal team is built for.
The takeaway
The supply chain conversation has mostly centered on npm and PyPI, because that is where the volume has been. This moves the frontier. Terraform providers put attacker code inside the process that holds your infrastructure credentials, which is a shorter path to real damage than a poisoned application dependency, and a capable, state-linked actor has now used that path twice in two weeks. The download numbers are small today. The technique is the part that scales. Audit your infrastructure dependencies with the same seriousness you give your application ones, rotate anything the affected pipelines could reach, and treat the too-good-to-be-true coding interview as the attack it usually is. If you want that discipline applied on an ongoing basis instead of after the fact, that is what our managed security hardening service and secure hosting environment are built around.