Go-Driven Supply Chain Attack Unleashes Destructive Linux Disk-Wiping Malware

Go-Driven Supply Chain Attack Unleashes Destructive Linux Disk-Wiping Malware

• The attack: Three malicious Go modules hid code that wipes Linux systems.
• How it worked: Obfuscated code in the modules downloaded a script that overwrote the main disk.
• Who found it: Researchers at the supply chain security firm Socket disclosed the modules in May 2025.
• What to do: Vet third-party modules before use and watch for unexpected downloads during builds.

Three Go modules with a wiper inside

Researchers at Socket found three malicious modules for the Go programming language that destroy data on the Linux systems they run on. The modules were published on GitHub under names meant to look useful to developers: prototransform, go-mcp and tlsproxy. They have since been taken down. Any system that already ran one is another matter.

A supply chain attack aimed at developers

Go is popular for cloud tools and infrastructure software, which makes Go developers an attractive target. Unlike the central registries of some other languages, Go fetches modules directly from source repositories such as GitHub. That makes it easier for attackers to publish look-alike packages that developers may pull in by mistake.

Why Go?

Go’s decentralized module system is part of the problem. Anyone can publish a module. Similar names make typosquatting easy, and a malicious module that gets built into a project can reach every server, laptop and CI runner where that software later runs.

How the wiper works

According to Socket, each module contained heavily obfuscated code that ran automatically. It checked that it was on Linux, then used wget to download a shell script from a remote server and executed it. The script overwrote the primary disk (/dev/sda) with zeros using dd, destroying the data and leaving the machine unable to boot.

Why it is so destructive

There is no ransom note. There is no decryption key to buy either, because nothing was encrypted. The only fix is to restore from backups. Socket said the obfuscation helped the code avoid quick detection by developers and basic scanners. The modules were removed from GitHub after the report.

What developers and security teams should do

Check your Go dependencies for the three module names, and look in build logs for unexpected wget or curl calls. More broadly, vet new third-party modules before adding them, especially ones with few users or recent creation dates.

Building Defensive Strategies

Dependency scanning that inspects what code actually does, not just known-bad versions, catches more of these attacks. Building in isolated environments limits the damage if a malicious module runs.

The lesson

Open-source registries are now a regular attack route. Treat every new dependency as code you are choosing to run. Keep offline backups.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.