{"id":"MAL-2026-17454","summary":"Malicious code in gogets.dev/btreex (Go)","details":"Part of the Graphalgo campaign. The module, first published around 2026-09-08, hides its payload in a ZIP archive disguised as a SQL file (btreex.sql). The payload is triggered when a specific price integer value is passed, and drops the same dual-channel RAT (Ethereum smart contract dead drop plus Slack bot token) used by gocommunity.io/orderedbtree.","modified":"2026-10-02T07:01:06.603753419Z","published":"2026-10-02T00:00:00Z","database_specific":{"iocs":{"domains":["gocommunity.io","gogets.dev","portfolio-devs.slack.com","portfolio-testers.slack.com","mediumstar.slack.com"],"files":[{"digests":{"sha256":"ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5"},"paths":["btreex.sql"]}]}},"references":[{"type":"ARTICLE","url":"https://www.aikido.dev/blog/graphalgo-terraform-go-modules"}],"affected":[{"package":{"name":"gogets.dev/btreex","ecosystem":"Go","purl":"pkg:golang/gogets.dev/btreex"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/go/gogets.dev/btreex/MAL-2026-17454.json"}}],"schema_version":"1.9.0","credits":[{"name":"Aikido Security","type":"FINDER"}]}