Silent Supply Chain Attack: Malicious Go Typosquat Siphoned Data to Pastebin for Four Years Undetected

According to The Socket Threat Research Team, a malicious Go package operated undetected for over four years, masquerading as a typosquat of trusted libraries and exfiltrating data to a public pastebin service. The rogue packages, identified as github[.]com/bpoorman/uuid and github[.]com/bpoorman/uid, imitate pborman/uuid and google/uuid to slip into projects while preserving UUID behaviour, but include a backdoor through a hidden Valid function.

When invoked, Valid silently encrypts and uploads caller-supplied data to dpaste[.]com using a hardcoded dpaste API token, with errors suppressed to avoid alerting the host application. This exfiltration channel was chosen to blend malicious traffic with normal development activity, shifting storage to a third‑party service that defenders may not monitor closely.

The findings note that the malicious package has been live for years and remains listed on pkg.go[.]dev at the time of writing, and first appeared in May 2021. Developers are urged to audit go[.]mod references to bpoorman and replace them with the legitimate google/uuid or pborman/uuid packages.