Malicious Go Packages Impersonate Google’s UUID Library to Steal Delicate Information

A hidden hazard has been lurking within the Go programming ecosystem for over 4 years.

Safety researchers from the Socket Menace Analysis Crew have found two malicious software program packages that impersonate fashionable Google instruments.

These faux packages, designed to trick busy builders, have been quietly stealing knowledge since Might 2021.

Socket AI Scanner’s analysis of the malicious github[.]com/bpoorman/uuid package — *Socket AI Scanner’s evaluation of the malicious* github[.]com/bpoorman/uuid bundle

The malicious packages are recognized as github.com/bpoorman/uuid and github.com/bpoorman/uid.

They’re designed to look nearly an identical to the legit and broadly used pborman and Google UUID libraries.

These actual libraries are the trade customary for producing distinctive identifiers for database rows, person periods, and job monitoring.

The “Typosquatting” Lure

The attacker, utilizing the username “bpoorman,” used a method known as “typosquatting.”

By selecting a reputation visually much like “pborman” (a legit maintainer), the attacker hoped builders would mistype the identify or fail to see the distinction in a protracted listing of dependencies.

page for the malicious github[.]com/bpoorman/uuid Go package — *web page for the malicious* `github[.]com/bpoorman/uuid` *Go bundle*

Crucially, the faux software program really works. It generates distinctive IDs similar to the true model. This enables it to remain hidden, as the applying doesn’t crash or present apparent errors. Nonetheless, the faux code comprises a secret backdoor.

The malicious code features a helper operate named Legitimate. Within the legit software program, builders may count on a operate with this identify to verify if an ID is formatted accurately. Within the faux model, it does one thing rather more harmful.

When a developer passes knowledge into this Legitimate operate equivalent to person IDs, electronic mail addresses, and even session tokens the code secretly encrypts that info.

It then sends the stolen knowledge to dpaste.com, a public text-sharing web site, utilizing a hardcoded API token. The attacker can then retrieve this knowledge anonymously.

As a result of the information is encrypted earlier than it leaves the sufferer’s laptop, customary safety instruments may not discover that delicate secrets and techniques are being stolen.

Regardless of being revealed years in the past, these packages have remained out there on the Go bundle discovery website and public mirrors.

Excerpt from the threat actor’s github[.]com/bpoorman/uid repository showing the uid.go exfiltration code — *Excerpt from the menace actor’s `github[.]com/bpoorman/uid` repository displaying the `uid.go` exfiltration code*

Whereas the general public index reveals “0 imports,” researchers warn that that is deceptive.

The index doesn’t rely downloads from personal company repositories or inner instruments, that means the precise variety of affected techniques is unknown.

Socket has reported each packages to the Go safety staff and requested that the writer’s account be suspended.

Builders are strongly suggested to audit their tasks and guarantee they’re utilizing github.com/google/uuid or github.com/pborman/uuid, and never the malicious “bpoorman” imposter.

Observe us on Google Information, LinkedIn, and X to Get Instantaneous Updates and Set GBH as a Most popular Supply in Google.