GRAPHALGO CAMPAIGN SPREADS TO TERRAFORM PROVIDERS AND GO MODULES

Summary from the TLDR InfoSec newsletter

Graphalgo malware appeared in two Terraform providers and two Go modules. Trigger conditions hide execution until targeted inputs appear, and the payload reports host data through Slack, receives encrypted commands through Slack and an Arbitrum Sepolia contract, then runs Go or Node code. Aikido recommends removing affected packages, isolating exposed hosts, rotating credentials, reviewing deployments, and reimaging machines.