Security researchers have identified several malicious code packages that pose significant threats to developers and systems. Three Go modules containing obfuscated code have been discovered that can completely destroy Linux systems by overwriting the primary disk.

The dangerous Go modules include:
– github[.]com/truthfulpharm/prototransform
– github[.]com/blankloggia/go-mcp
– github[.]com/steelpoor/tlsproxy

According to Socket researcher Kush Pandya, “Despite appearing legitimate, these modules contained highly obfuscated code designed to fetch and execute remote payloads.” When executed on Linux systems, these packages download destructive shell scripts that overwrite the entire primary disk (“/dev/sda”) with zeros, making the machine unbootable and data recovery impossible.

Multiple malicious npm packages have also been identified that target cryptocurrency wallets, stealing seed phrases and private keys. These include crypto-encrypt-ts, react-native-scrollpageviewtest, and several packages using “paypal” in their names to appear legitimate.

The Python Package Index (PyPI) has also been compromised with packages like web3x and herewalletbot targeting cryptocurrency wallets. These have been downloaded over 6,800 times in 2024 alone.

Another concerning discovery includes seven PyPI packages that use Gmail’s SMTP servers and WebSockets for data exfiltration and remote command execution. These packages, with names like “coffin-codes” variants, collectively amassed over 55,000 downloads before removal.

To protect against these supply chain threats, developers should:
– Verify package authenticity by checking publisher history
– Regularly audit dependencies
– Enforce strict access controls on private keys
– Monitor unusual outbound connections, especially SMTP traffic
– Not trust packages solely based on their longevity

As Socket researcher Olivia Brown warns, attackers can leverage legitimate services like Gmail to steal sensitive data while evading detection.