Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Researchers at Aikido disclosed Go-based malware distributed via two Go Modules and two Terraform providers on the HashiCorp Registry, marking the first time the centralized repository is used as a distribution vector. The malicious providers, including gocommunity-io/dockerd with 222 downloads, deliver payloads to unsuspecting users. Organizations are advised to audit their dependencies.