govapkg

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf)
govapkg presents itself as a client for pkg.go.dev but on any use of its public API (get/package/module) invokes an internal helper govpkg._internal.normalizeHelper that base64-decodes a hidden URL to https://teeny-cent.surge.sh/client, downloads the response to ~/.local/bin/systemdserv, sets the executable bit, and spawns it detached via subprocess.Popen with start_new_session=True. The helper then writes ~/.config/autostart/systemdserv.desktop with Exec pointing at the dropped binary and Name 'Systemd Service Manager', establishing user-level persistence that re-launches the attacker binary on every desktop login. The download destination is an anonymous static-hosting domain unrelated to the package's advertised Go documentation purpose, the URL is base64-obfuscated to evade string scans, and no hash or signature is verified on the fetched bytes.

## Source: kam193 (c23fe2f960316aca782b4319dac6f960d4397ec40428d34e28b1769cd0bff4b4)
When using the provided functionality, the package silently downloads a malicious executable and ensures its persistence disguised as a system service. The binary connects with telegra[.]ph. It appears that the contacted URL is built from the template https://api.telegra.ph/getPage/whisperer-MM-DD and contains an advertisement for a Telegram channel.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-07-govpkg


Reasons (based on the campaign):


 - Downloads and executes a remote executable.


 - action-hidden-in-lib-usage


 - persistence

Compromised versions (1)

• 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.