MAL-2026-17454

    Dashboard / Malicious Package / MAL-2026-17454

    MAL-2026-17454

    Published: 2 Oct 2026Last Modified: 2 Oct 2026

    Summary: Malicious code in gogets.dev/btreex (Go)

    Details: Part of the Graphalgo campaign. The module, first published around 2026-09-08, hides its payload in a ZIP archive disguised as a SQL file (btreex.sql). The payload is triggered when a specific price integer value is passed, and drops the same dual-channel RAT (Ethereum smart contract dead drop plus Slack bot token) used by gocommunity.io/orderedbtree.

    References: https://www.aikido.dev/blog/graphalgo-terraform-go-modules

    Affected packages

    Package

    Name: gogets.dev/btreex

    Purl: pkg:golang/gogets.dev/btreex

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions