ABUSING GO'S INFRASTRUCTURE

Summary from the TLDR Web Dev newsletter

Arbitrary data, including non-Go code, can be uploaded to Go's checksum database and proxy. This is possible because the checksum database automatically fetches and stores module data if it's not already present. This mechanism can be exploited for malicious purposes, such as bypassing download restrictions, storing malware payloads, or implementing command and control (C2) channels.