Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Cybersecurity researchers have uncovered Go-based malware distributed through malicious Terraform providers and Go modules hosted on the HashiCorp registry. This marks the first known instance of threat actors leveraging the HashiCorp centralized repository as a distribution vector for malicious payloads. The identified malicious packages include 'gocommunity-io/dockerd' and 'kreuzwenker/' among others. The attack represents a novel supply chain threat targeting developers and infrastructure-as-code workflows. The malware was written in Go, consistent with a growing trend of attackers using Go for cross-platform malicious tooling. The use of a trusted, widely-used registry like HashiCorp's increases the likelihood of successful compromise. Developers and DevOps teams using Terraform are advised to audit their provider dependencies immediately.