---
id: 8533
title: "Graphalgo campaign spreads to Terraform providers and Go Modules"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/graphalgo-terraform-go-modules"
published_at: "2026-09-22T00:00:00Z"
tags: ["supply-chain", "web3", "go", "typosquatting", "terraform", "rat", "graphalgo", "blockchain-c2"]
phying_url: "https://phying.com/item/8533"
lang: en
---

# Graphalgo campaign spreads to Terraform providers and Go Modules

## Summary

Go malware has appeared in two Terraform providers and two Go modules — the first observed abuse of Terraform providers. The Graphalgo Go port hides a hash-gated trigger with blockchain and Slack C2.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-09-22T00:00:00Z
- **Original:** https://www.aikido.dev/blog/graphalgo-terraform-go-modules
- **Phying News:** https://phying.com/item/8533