[graphalgo]

September 24, 2026

• Terraform providers used as a malware channel for the first time. Aikido flagged gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads) in HashiCorp's registry plus two Go modules, delivering Go malware overlapping with the DPRK-linked Graphalgo campaign. Related npm packages take orders from an Ethereum Sepolia testnet contract, keep a second channel over Slack, and inflate download counts with GitHub Actions workers (The Hacker News) (earlier coverage). · Supply Chain & CI/CD

in The Exploit Is Public, the Ubuntu Patch Isn't