Malicious Go Packages Mimic as Google’s UUID Library to Exfiltrate Sensitive Data
Security researchers have identified a persistent supply chain attack affecting the Go programming community.
Security researchers have identified a persistent supply chain attack affecting the Go programming community.
The Socket Threat Research Team has discovered two malicious packages: github.com/bpoorman/uuid and github.com/bpoorman/uid . These packages have been misappropriating data from developers for an extended period through a technique known as "typosquatting."
The malicious packages emulate legitimate libraries such as github.com/google/uuid and github.com/pborman/uuid . The attacker used the username bpoorman to imitate the recognized maintainer pborman . These libraries are commonly utilized in Go applications, and developers often recall library names from memory, making them susceptible to typos.
Once installed, the malicious package operates similarly to the legitimate one, generating unique identifiers (UUIDs), making detection difficult.
Security researchers have identified a persistent supply chain attack affecting the Go programming community.
The package includes a concealed function named Valid , which serves as a backdoor. In a legitimate library, a similar function verifies ID format correctness. However, in this version, it encrypts data such as user IDs, session tokens, or email addresses passed to it.
Subsequently, the stolen data is uploaded to dpaste.com , a public text-sharing platform, via a hardcoded API token . This process occurs without visible error messages or alerts.
This threat has been persistent, with the bpoorman/uuid package first published in May 2021 and remaining active within the Go ecosystem for over four years. At the time of discovery, it was still listed on pkg.go.dev , the primary site for Go packages.
Although the uid package was removed from the search index, it remains accessible through public mirrors. This discovery emphasizes the importance for developers to thoroughly audit their dependencies.
Experts recommend verifying go.mod files to ensure the correct pborman libraries are used and not the malicious bpoorman impostor. Treat all new dependencies as untrusted until verified.
Based on reporting by Cyber Security News.