gogets.dev/btreex

{"modified":"2026-10-02T00:00:00Z","schema_version":"1.7.4","id":"MAL-2026-17454","summary":"Malicious code in gogets.dev/btreex (Go)","details":"Part of the Graphalgo campaign. The module, first published around 2026-09-08, hides its payload in a ZIP archive disguised as a SQL file (btreex.sql). The payload is triggered when a specific price integer value is passed, and drops the same dual-channel RAT (Ethereum smart contract dead drop plus Slack bot token) used by gocommunity.io/orderedbtree.","affected":[{"package":{"ecosystem":"Go","name":"gogets.dev/btreex"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"references":[{"type":"ARTICLE","url":"https://www.aikido.dev/blog/graphalgo-terraform-go-modules"}],"credits":[{"name":"Aikido Security","type":"FINDER"}],"database_specific":{"iocs":{"domains":["gocommunity.io","gogets.dev","portfolio-devs.slack.com","portfolio-testers.slack.com","mediumstar.slack.com"],"files":[{"digests":{"sha256":"ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5"},"paths":["btreex.sql"]}]}}}