Supply Chain Incident
Go BoltDB typosquat module proxy backdoor
Socket researchers disclosed a backdoored Go module typosquatting BoltDB that persisted through Go Module Proxy caching even after the source repository tag was changed.
ConfidenceHigh
Evidence LevelResearcher
Attack StageDependency Resolution
Source Artifact DivergenceYes
Attribution ConfidenceSuspected
Affected Packages
Affected Releases
- github.com/boltdb-go/bolt@v1.3.1pkg:golang/github.com/boltdb-go/bolt@v1.3.1 · published 2021-11-01Release
Repositories
Organizations
No structured records.
Maintainers
No structured records.
Threat Actors
- boltdb-go operator
Campaigns
No structured records.
Build Systems
No structured records.
Distribution Channels
- GitHub repository
- Go Module Proxy
Compromised Accounts
No structured records.
Connected Entities
- boltdb-go operatorThreat Actor
- boltdb-go/boltRepository
- GitHub repositoryDistribution Channel
- github.com/boltdb-go/boltPackage
- github.com/boltdb-go/bolt@v1.3.1Release
- Go Module ProxyDistribution Channel
Attribution Evidence
Socket identifies the boltdb-go GitHub alias as the distribution identity for the typosquat; Threatpedia models it as a provisional operator without broader attribution.
References
- Go Supply Chain Attack: Malicious Package Exploits Go Module Proxy Caching for PersistenceSocket · 2025-02-04
- Go checksum database lookup for github.com/boltdb-go/bolt v1.3.1sum.golang.org · 2025-02-04