Supply-chain security firm Socket has published research findings describing a Go module that posed as a DNS and subdomain scanner while acting as a first-stage Windows malware loader. The firm then traced it to a network of 222 GitHub repositories across 190 accounts. The module published its first version on January 24 this year and has since accumulated more than 1,200 versions, over 700 of them malicious. Socket tracks the campaign as “Operation Muck and Load” and reported the module to the Go security team, which blocked it from the Go module proxy.

Go deeper with TH Premium: AI and data centers

(Image credit: Microsoft)

Photonics and high-speed data movement is the next big AI bottleneck

The data center cooling state of play

Massive AI data center buildouts are squeezing energy supplies

Ultra Ethernet: The data center interconnection of tomorrow

Go derives a pseudo-version from the commit timestamp and hash for any commit that lacks a semantic version tag.…