github.com/ornatedoctrin/layout

GHSA-2237-qq4x-m83q

Malicious code in github.com/ornatedoctrin/layout (Go)

Details

**Severity:** Critical

**Affected versions:** `> 0`

---
_-= Per source details. Do not edit below this line.=-_

## Source: google-open-source-security (9edf608032bbc84563da5c04376d6add49123c8fdba94883c239857eb45afc40)
Malcious typosquatting Go packages targeting Linux and macOS systems used to
as a loader to download and run another malicious payload.

**References:**
- https://github.com/ossf/malicious-packages/blob/26c49c064c9462ff2e3e03ff1f77d613160e3397/osv/malicious/go/github.com/ornatedoctrin/layout/MAL-2025-2546.json
- https://github.com/ossf/malicious-packages/blob/6aec0500e3123ad96d66040006eb6a8e60609d56/osv/malicious/go/github.com/ornatedoctrin/layout/MAL-2025-2546.json
- https://github.com/ossf/malicious-packages/blob/a13a40ff863bab84b3f8b7b4a403e5533760db38/osv/malicious/go/github.com/ornatedoctrin/layout/MAL-2025-2546.json
- https://socket.dev/blog/typosquatted-go-packages-deliver-malware-loader
- https://github.com/ossf/malicious-packages/blob/f74ec115ff98d0b6e7642402da084d7a9d9a790b/osv/malicious/go/github.com/ornatedoctrin/layout/MAL-2025-2546.json
- https://github.com/ossf/malicious-packages/blob/ffde2398bee5c960c53576070170a550a34d9f62/osv/malicious/go/github.com/ornatedoctrin/layout/MAL-2025-2546.json
- https://github.com/ossf/malicious-packages/blob/610215649c741141a637ecdcf2615a0a4c263618/osv/malicious/go/github.com/ornatedoctrin/layout/MAL-2025-2546.json
- https://github.com/ossf/malicious-packages/blob/a38ecee305c88a229e05893a0413264b62143ce2/osv/malicious/go/github.com/ornatedoctrin/layout/MAL-2025-2546.json

Compromised versions (1)

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.