[Stanley]

Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor

Cybersecurity researchers have disclosed details of a malicious Go module that's designed to harvest passwords, create persistent access via SSH, and deliver a Linux backdoor named Rekoobe.
The Go module, github[.]com/xinfeisoft/crypto, impersonates the legitimate "golang.org/x/crypto" codebase, but injects malicious code that's responsible for exfiltrating secrets entered via terminal password

https://thehackernews.com/2026/02/malici...teals.html

[W1NK1LL3RX]

Agree, this is a serious supply chain risk because it abuses developer trust, not just a single endpoint.
A fake package that steals terminal secrets and adds SSH persistence can quietly turn a normal install into long-term compromise.
That’s exactly why package verification and source checking matter so much.