Aikido disclosed Go-based malware distributed through two Go modules and two Terraform providers, the first time attackers have used HashiCorp's centralized registry as a distribution vector. The flagged items include kreuzwenker/docker, with 1,449 downloads, and gocommunity-io/dockerd, alongside two Go modules. The malware overlaps with the Graphalgo campaign that ReversingLabs attributed to North Korean actors in February, in which developers are approached on LinkedIn, Facebook, or job forums by fake Web3 companies and asked to run a benign repository that pulls the malicious behavior from a dependency. The discovery coincides with a fresh batch of malicious npm and PyPI packages delivering the same threat, flagged by Checkmarx, JFrog, and SafeDep.
HashiCorp, Veeam, and Django patched critical flaws the same week, led by a top-severity bug in HashiCorp's Terraform MCP Server, which connects AI assistants to Terraform. Tracked as CVE-2026-16498 and scored 10.0, it is a cross-tenant flaw in the server's multi-user HTTP mode: its cache looked up clients by session identifier alone, without binding a cached client to the token that created it, so anyone who obtained another user's session ID could run Terraform actions with that user's credential. Only the shared HTTP deployment is affected, not local single-user mode. Veeam separately fixed an unauthenticated console flaw exposing agent credentials, and Django a code-execution bug in spatial queries.
TrustStrike Labs