Supply chain · go · High

Malicious Go Package `gogets.dev/btreex` Steals Credentials

Threat Engine Auto-Feed · data current as of 2026-10-02

A malicious Go module, `gogets.dev/btreex`, has been identified as part of the Graphalgo campaign. It contains a hidden payload designed for credential and secret theft, triggered by a specific integer value. Organizations using this package are at high risk of compromise.

  • Package: go / gogets.dev/btreex
  • Affected versions: > 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The Go module `gogets.dev/btreex`, first published around 2026-09-08, contains malicious code. The payload is concealed within a ZIP archive disguised as a SQL file (btreex.sql) and is activated when a specific price integer value is passed. This package is associated with the broader Graphalgo campaign.

How the attack works

This is a supply-chain attack where a seemingly legitimate software package is compromised with malicious code. The attacker embeds a hidden payload that, upon specific conditions being met (in this case, a particular integer value), executes to exfiltrate sensitive information such as credentials or secrets from the compromised system. This type of attack leverages trust in open-source dependencies.

Who's exposed

Profiles most at risk

  • Development teams using the Go ecosystem
  • Organizations whose CI/CD pipelines pull `gogets.dev/btreex` into their builds
  • Teams that have integrated `gogets.dev/btreex` into their projects

Conditions that increase exposure

  • Unpinned dependencies that automatically update to the latest malicious version
  • Lack of dependency lockfiles (e.g., `go.mod` with pinned versions) in projects
  • Use of internal mirrors or caches that may have ingested the malicious package
  • Any build or deployment system that executes code from `gogets.dev/btreex`

Blast-radius scenarios

  • An attacker could gain unauthorized access to sensitive systems or data by stealing credentials or secrets.
  • Compromised build environments could lead to further supply chain attacks if attacker gains access to signing keys or deployment credentials.
  • Exfiltration of proprietary code or data from development or production environments.

What to do (defensive)

Detect

  • Scan `go.mod` and `go.sum` files for `gogets.dev/btreex` in any version.
  • Review network traffic for unusual outbound connections from systems running applications that depend on `gogets.dev/btreex`.
  • Monitor for unexpected file system changes or process executions on systems where `gogets.dev/btreex` is used.

Contain

  • Immediately isolate any systems or environments found to be running or building with `gogets.dev/btreex`.
  • Block `gogets.dev/btreex` from being pulled from Go module proxies or internal registries.
  • Temporarily halt deployments of applications that depend on the Go ecosystem until a full audit is complete.

Remediate

  • Remove `gogets.dev/btreex` from all project dependencies and update `go.mod` and `go.sum` files.
  • Force-update all dependencies to known good, pinned versions, and ensure lockfiles are committed.
  • Rotate all credentials and secrets that may have been exposed on systems where `gogets.dev/btreex` was present.
  • Perform a comprehensive security audit of all affected systems and codebases.

Frontier verdict — High

Prioritize immediate detection and removal of `gogets.dev/btreex` due to its critical severity and credential theft capabilities.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.