github.com/boltdb-go/bolt

GHSA-9gmm-c6g7-rqg9

Malicious code in github.com/boltdb-go/bolt (Go)

Details

**Severity:** Critical

**Affected versions:** `> 0`

---
_-= Per source details. Do not edit below this line.=-_

## Source: google-open-source-security (9323424d3dfc7569b307842f79fb0c4bd960808214ec219f536fd5bb747422b2)
This malicious Go package is a typosquat of the legitimate BoltDB package.
It contains a backdoor that enables remote code execution.

**References:**
- https://github.com/ossf/malicious-packages/blob/26c49c064c9462ff2e3e03ff1f77d613160e3397/osv/malicious/go/github.com/boltdb-go/bolt/MAL-2025-2545.json
- https://github.com/ossf/malicious-packages/blob/6aec0500e3123ad96d66040006eb6a8e60609d56/osv/malicious/go/github.com/boltdb-go/bolt/MAL-2025-2545.json
- https://github.com/ossf/malicious-packages/blob/a13a40ff863bab84b3f8b7b4a403e5533760db38/osv/malicious/go/github.com/boltdb-go/bolt/MAL-2025-2545.json
- https://socket.dev/blog/malicious-package-exploits-go-module-proxy-caching-for-persistence
- https://github.com/ossf/malicious-packages/blob/f74ec115ff98d0b6e7642402da084d7a9d9a790b/osv/malicious/go/github.com/boltdb-go/bolt/MAL-2025-2545.json
- https://github.com/ossf/malicious-packages/blob/ffde2398bee5c960c53576070170a550a34d9f62/osv/malicious/go/github.com/boltdb-go/bolt/MAL-2025-2545.json
- https://github.com/ossf/malicious-packages/blob/610215649c741141a637ecdcf2615a0a4c263618/osv/malicious/go/github.com/boltdb-go/bolt/MAL-2025-2545.json
- https://github.com/ossf/malicious-packages/blob/a38ecee305c88a229e05893a0413264b62143ce2/osv/malicious/go/github.com/boltdb-go/bolt/MAL-2025-2545.json

Compromised versions (1)

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.