---
title: "Graphalgo Malware in Go Modules and Terraform Providers"
url: https://erroneo.us/security/briefs/graphalgo-go-modules-terraform-provider-typosquats/
description: "Two Go modules and two Terraform providers, including a kreuzwerker/docker typosquat, hid a Go RAT. Check go.mod and .tf files; reimage hosts that ran them."
type: security-brief
section: "Security Digest"
date_published: 2026-09-22
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: []
severity: "high"
exploited: "in-the-wild"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Graphalgo Malware in Go Modules and Terraform Providers

**Verdict: Check exposure.** Grep your go.mod, go.sum and Terraform files for four names; if none match you are done, and if one does, treat the machine as compromised.

- **Who must act:** Go developers and infrastructure teams who added gocommunity.io/orderedbtree, gogets.dev/btreex, or the kreuzwenker/docker or gocommunity-io/dockerd Terraform providers, including through a coding task or sample repository someone sent them.
- **Who can relax:** Teams whose dependency files contain none of the four names, and Terraform users whose lock files reference the genuine kreuzwerker/docker provider.
- **Affected:** gocommunity.io/orderedbtree (all versions; first published Aug 11, 2026); gogets.dev/btreex (all versions; first published Sep 8, 2026); Terraform provider kreuzwenker/docker (one-letter typosquat of kreuzwerker/docker); Terraform provider gocommunity-io/dockerd (published early September 2026)
- **Fixed:** No fixed versions: remove the packages; proxy.golang.org refuses to serve both Go modules (checked Oct 21, 2026); Terraform Registry returns 'provider not found' for both providers (checked Oct 21, 2026)
- **CVEs:** none
- **CISA KEV:** no · **Exploitation:** Exploited in the wild

## What to do

1. Search Go projects: grep -rnE 'gogets\.dev/btreex|gocommunity\.io/orderedbtree' --include=go.mod --include=go.sum .
2. Search Terraform code and lock files: grep -rnE 'kreuzwenker/docker|gocommunity-io/dockerd' --include='*.tf' --include='.terraform.lock.hcl' .
3. Fix the provider source to kreuzwerker/docker and run terraform init -upgrade.
4. If a match ran anywhere, isolate and reimage the host, then rotate every credential it could reach, cloud and infrastructure credentials first.
5. Review commits, package publishes, terraform apply runs and CI jobs from that host for unauthorized activity.

### How to check if you are affected

- Look for examples/resources/docker_container/import-resource.sqlite3 (SHA-256 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f) in provider caches, and btreex.sql (SHA-256 ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5) in the Go module cache.
- Check for detached 'go run .' processes started by terraform or by test runs.
- Alert on build or developer hosts talking to Slack workspaces portfolio-devs or portfolio-testers, or polling Arbitrum Sepolia contract 0xAD02b5cDE693529d3bdA0266299501ad0193036C.
- Search DNS logs for gocommunity.io and gogets.dev.

## What happened

On September 22, 2026, [Aikido Security](https://www.aikido.dev/blog/graphalgo-terraform-go-modules) reported four malicious packages carrying a Go port of the Graphalgo malware. There were two Go modules, `gocommunity.io/orderedbtree` and `gogets.dev/btreex`, and two Terraform providers, `gocommunity-io/dockerd` and `kreuzwenker/docker`. The last is a one-letter typosquat of [kreuzwerker/docker](https://registry.terraform.io/providers/kreuzwerker/docker/latest), the widely used Docker provider that Aikido says has 56 million reported downloads. The samples share blockchain and Slack infrastructure and a public key with earlier npm samples. [ReversingLabs](https://www.reversinglabs.com/blog/fake-recruiter-campaign-crypto-devs) first documented Graphalgo in February 2026. It described the campaign as fake recruiters handing developers coding tasks that pull in malicious npm and PyPI dependencies, and attributed it to Lazarus Group based on technique similarity.

The payloads hide behind triggers. In the Terraform providers, code in `resource_docker_container_funcs.go` activates only when the SHA-256 of the container name and network ID matches a fixed value, which then serves as an AES key. It decrypts an archive disguised as `import-resource.sqlite3` and runs it with a detached `go run .`. The Go modules fire on a specific "price" integer, and `btreex` hides its archive in a file named `btreex.sql`. The second stage is a Go remote access trojan. It checks in with host and user details, takes commands over Slack and over an Ethereum contract on Arbitrum Sepolia, and can run Go or JavaScript code or delete itself.

## Who is affected

Only projects that pulled one of the four names. `gocommunity.io/orderedbtree` was first published on August 11 and `gogets.dev/btreex` on September 8. The second came with forged commits backdated to November 2025 so the repository looked established. Download counts for the malicious packages were not disclosed as of October 21, 2026. OSV lists both modules as malicious in [MAL-2026-17454](https://osv.dev/vulnerability/MAL-2026-17454) and [MAL-2026-17453](https://osv.dev/vulnerability/MAL-2026-17453). On October 21, proxy.golang.org refused to serve either module, flagging both as malicious, and the Terraform Registry returned "provider not found" for both providers.

## Do you really need to act?

Most teams need one grep and nothing else. Because of the triggers, a casual install may never fire. The payload waits for a repository or Terraform config that supplies the unlocking values. That fits Graphalgo's fake-interview playbook, though Aikido did not say how these packages reached victims. If a candidate exercise, take-home task or "sample infrastructure" repository reached you in August or September, check it. A hit on a machine with cloud or Terraform credentials is serious, because the attacker gets a live remote shell next to your infrastructure keys.

The Go proxy block protects you only if you fetch through proxy.golang.org. With `GOPROXY=direct`, or a private mirror that cached the modules earlier, they may still resolve.

## What to do now

1. Go: `grep -rnE 'gogets\.dev/btreex|gocommunity\.io/orderedbtree' --include=go.mod --include=go.sum .` across your repositories, and purge the names from any internal module mirror.
2. Terraform: `grep -rnE 'kreuzwenker/docker|gocommunity-io/dockerd' --include='*.tf' --include='.terraform.lock.hcl' .`. Correct the `required_providers` source to `kreuzwerker/docker` and run `terraform init -upgrade`.
3. On any match that ran, isolate and reimage the host. The command-and-control channels may still reach it.
4. Rotate every credential the host could read, starting with cloud and Terraform credentials. Then review its commits, publishes, `terraform apply` runs and CI jobs.
5. Where build hosts have no business talking to blockchain RPC services or Slack, alert on that traffic.

## How to tell if you were hit

Search provider caches (`.terraform/providers`, `~/.terraform.d/plugins`) for `import-resource.sqlite3` with SHA-256 `5f892a54…977d0f`. Search the Go module cache (`$(go env GOMODCACHE)`) for `btreex.sql` with SHA-256 `ab01686d…5d62f5`. Look for detached `go run .` processes spawned by `terraform` or test runs. Check DNS and proxy logs for `gocommunity.io`, `gogets.dev`, the Slack workspaces `portfolio-devs` and `portfolio-testers`, and calls to Arbitrum Sepolia contract `0xAD02b5cDE693529d3bdA0266299501ad0193036C`.

## Timeline

- Feb 11, 2026 — ReversingLabs documents the Graphalgo fake-recruiter campaign on npm and PyPI.
- Aug 11, 2026 — gocommunity.io/orderedbtree is first published.
- Sep 8, 2026 — gogets.dev/btreex is first published. The gocommunity-io/dockerd provider appears in early September.
- Sep 22, 2026 — Aikido publishes its research, updated Sep 24.
- Oct 2, 2026 — OSV publishes MAL-2026-17453 and MAL-2026-17454.

## Sources

1. [Aikido Security — Graphalgo campaign spreads to Terraform providers and Go modules](https://www.aikido.dev/blog/graphalgo-terraform-go-modules)
2. [OSV — MAL-2026-17454: Malicious code in gogets.dev/btreex](https://osv.dev/vulnerability/MAL-2026-17454)
3. [OSV — MAL-2026-17453: Malicious code in gocommunity.io/orderedbtree](https://osv.dev/vulnerability/MAL-2026-17453)
4. [Terraform Registry — kreuzwerker/docker (genuine provider)](https://registry.terraform.io/providers/kreuzwerker/docker/latest)
5. [ReversingLabs — Fake recruiter campaign targets crypto devs (Graphalgo)](https://www.reversinglabs.com/blog/fake-recruiter-campaign-crypto-devs)

---
Source page: https://erroneo.us/security/briefs/graphalgo-go-modules-terraform-provider-typosquats/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt