GO MODULE MIRROR SERVED BACKDOOR TO DEVS FOR 3+ YEARS

Summary from the TLDR InfoSec newsletter

Researchers from Socket discovered that Go Module Mirror had been hosting a malicious Go package for over three years. Go Module Mirror is a caching service that Google runs to cache modules for quicker downloads when building Go programs. The attackers typosquatted an archived Go package, published a version with a backdoor embedded, and then changed their repo back to look like the benign module.