A new wave of supply chain attacks attributed to North Korean (aka **DPRK**) threat actors has been identified, showcasing a concerning evolution in their distribution methods. For the first time, malicious Go-based malware is being propagated through legitimate channels like **HashiCorp's Terraform** registry and Go Modules. ### Novel Distribution Vectors Emerge According to research by **Aikido**, the following **Terraform** providers and Go Modules were found to be distributing malicious payloads: * **gocommunity-io/dockerd** (222 downloads) * **kreuzwenker/docker** (1,449 downloads) * **gocommunity.io/orderedbtree** * **gogets.dev/btreex** This marks a critical shift, as threat actors are now exploiting the **Terraform** registry, a centralized repository for infrastructure-as-code components, to deliver their malicious software. ### Links to Graphalgo and npm Compromises The malware distributed through these new vectors exhibits strong overlaps with **Graphalgo**, a campaign first documented by **ReversingLabs** in February and subsequently attributed to North Korean state-sponsored groups. The **Graphalgo** campaign typically involves social engineering tactics, where developers are lured via platforms like **LinkedIn** and **Facebook** or fake job postings from non-existent Web3 companies. These developers are then asked to complete coding tasks, inadvertently introducing malicious dependencies published on **npm** or **PyPI**. This latest discovery coincides with the identification of new malicious **npm** packages delivering the same malware, as highlighted by **Checkmarx**, **JFrog**, and **SafeDep**. Some of these flagged packages include: * **indexed-btree** * **mathsbase** * **mathmain** * **math-universe** * **modern-events** * **quick-events** * **crypto-hasher** * **events-router** * **sort-btree** * **graphcore-js** * **graphlib-js** Analysis of these packages reveals a targeted operation, with malware execution often triggered only after specific cryptographic operations are performed. **JFrog** elaborated on the sophistication, stating, "The payload decrypts only when the victim solves a linear system with one specific matrix, takes its orders from a smart contract on the **Ethereum Sepolia** testnet, keeps a second command channel open over **Slack**, and hides behind download counts manufactured by a farm of **GitHub Actions** workers." ### Sophisticated Dual C2 Channels The attack chain leads to an encrypted payload, whose exact functions remain unknown due to asymmetric cryptography. The implant is designed to communicate with a **Slack** channel, polling the `conversations.history` endpoint every 10 seconds to receive commands, including instructions for file transfers.  **Aikido** confirmed that the malware distributed via **Terraform** providers and Go Modules is a Go port sharing the same blockchain and **Slack** infrastructure as the **npm** version. It features dual command-and-control (**C2**) channels, utilizing blockchain dead drops and a **Slack** bot token. Initially, the malware collects system information, including hardware attributes, OS, hostname, and node availability, transmitting this data to the attacker-controlled **Slack** channel. Security researcher **Oliver Smith** noted, "The malware generates shared keys by combining its ephemeral key with two threat actor public keys. The shared key allows the malware to communicate with infected clients using shared channels without exposing C2 communications or leaking messages between infected hosts." The blockchain-based **C2** retrieves encrypted commands every three seconds from an **Ethereum** smart contract on the **Arbitrum Sepolia** testnet, which are then executed as Go or JavaScript code. "The **C2** mechanism is further indication that this malware is part of a targeted operation," **Smith** added. "This is a notably sophisticated implementation of a blockchain dead drop that integrates bidirectional communication with minimal risk of information leakage or disruption." **Karlo Zanki**, a security researcher at **Socket**, emphasized that **Graphalgo** continues to employ similar operational playbooks, likely using fake job interviews as the primary initial access vector. "Execution is gated by a basic check for data likely supplied by the front-end component," **Zanki** explained, suggesting it's either narrowly targeted or designed to hinder analysis. ### Is Terraform Registry the New Supply Chain Attack Vector? The emergence of malicious **Terraform** providers is a novel, yet unsurprising, tactic, as it offers a direct path to critical production credentials, as **Aikido** pointed out. This signifies an expansion of the campaign beyond traditional **npm** and **PyPI** repositories. This isn't the first instance of North Korean adversaries using **Terraform** for malware. Last week, **SentinelOne** detailed how the **TraderTraitor** activity cluster utilized weaponized **Terraform** lock files to deliver Rust-based backdoors from custom **Terraform** provider registries. While it's too early to definitively conclude that **DPRK**-linked threat actors are systematically adopting **Terraform** registries as a new distribution tactic, their recent appearance in two distinct campaigns makes coincidence less likely. "These threat actors have a history of introducing new infection techniques and applying successful methods across multiple campaigns," **Zanki** concluded. "**Terraform** registries may represent the next distribution channel they adopt at scale." ### Malicious npm Package Links to PolinRider In a related development, **CloudSEK** highlighted a previously unreported JavaScript loader named **GHAPPIER**, distributed following the compromise of the legitimate **npm** package, "@dforge-core/dforge-mcp." The method of compromise is unknown but suspected to involve a malicious extension or package infecting the maintainer's machine. The **GHAPPIER** loader's primary objective is to fetch and execute code from an operator-controlled server, allowing dynamic payload alteration. The malicious version (0.2.21) was live on **npm** for approximately 35 minutes on September 9, 2026, before being reverted. This loader has been observed in 65 public repositories across 22 distinct accounts, indicating a broader reach.