MAL-2025-2545

    Dashboard / Malicious Package / MAL-2025-2545

    MAL-2025-2545

    Published: 19 Mar 2025Last Modified: 4 Feb 2026

    Summary: Malicious code in github.com/boltdb-go/bolt (Go)

    Details: Source: google-open-source-security (9323424d3dfc7569b307842f79fb0c4bd960808214ec219f536fd5bb747422b2) This malicious Go package is a typosquat of the legitimate BoltDB package. It contains a backdoor that enables remote code execution.

    References: https://socket.dev/blog/malicious-package-exploits-go-module-proxy-caching-for-persistence

    Affected packages

    Package

    Name: github.com/boltdb-go/bolt

    Purl: pkg:golang/github.com/boltdb-go/bolt

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    MAL-2025-2545 | CVE-DB