Graphalgo Malware Hits Terraform Providers and Go Modules: Packages to Remove and Credentials to Rotate
Security firm Aikido reported on September 22, 2026 that Graphalgo-linked Go malware had been distributed through two Terraform providers and two Go modules. The confirmed package names are gocommunity-io/dockerd, kreuzwenker/docker, gocommunity.io/orderedbtree and gogets.dev/btreex.
The Terraform name kreuzwenker/docker is especially easy to confuse with the legitimate and widely used kreuzwerker/docker provider. Aikido classifies any version of the four malicious names as an indicator of compromise and recommends treating a developer workstation or CI/CD runner that installed one as compromised.
The practical response is to inventory Terraform source declarations and lockfiles plus Go dependency metadata, isolate affected systems, preserve evidence, remove the malicious dependency, and rotate credentials that were available to the affected user or automation environment. Developer and CI hosts deserve particular attention because they commonly hold source-control, cloud and deployment credentials.
Confirmed malicious package names
| Ecosystem | Package/provider | Why it matters |
|---|---|---|
| Terraform Registry | gocommunity-io/dockerd |
Aikido identified malicious code in the provider |
| Terraform Registry | kreuzwenker/docker |
Typosquat of legitimate kreuzwerker/docker |
| Go module | gocommunity.io/orderedbtree |
Aikido identified the Graphalgo-linked Go malware |
| Go module | gogets.dev/btreex |
Aikido identified the same malware family with a conditional activation path |
The legitimate Docker provider is kreuzwerker/docker, with an r before the final ker. That one-character distinction is important when reviewing Terraform configuration and .terraform.lock.hcl.
What Aikido found
Aikido says the Go malware overlaps with the Graphalgo npm campaign and shares infrastructure and cryptographic material with recent JavaScript samples. Its analysis found command-and-control mechanisms involving Slack and blockchain infrastructure.
The malicious Terraform providers contained conditional execution logic tied to specific runtime input. The gogets.dev/btreex module also used a specially crafted input condition. These activation checks mean package presence is the safer incident-response signal: an operator should not infer safety merely because obvious malicious behavior was never observed during normal testing.
Aikido's telemetry found 18 unique hostnames in plaintext check-in data associated with the broader activity: three Windows, five Linux and ten macOS systems. The researchers describe the observed operation as small and targeted. Those counts represent Aikido's visibility into the campaign, not a complete victim count.
How to check Terraform projects
Start with source configuration and dependency state. Search repositories for the two provider namespace/name combinations:
gocommunity-io/dockerdkreuzwenker/docker
Review .terraform.lock.hcl in every relevant workspace and CI checkout, and compare provider source addresses with the intended configuration. The near-match between kreuzwenker/docker and kreuzwerker/docker makes exact spelling more useful than a broad search for the word docker.
Also inspect CI/CD configuration, reusable Terraform modules and generated deployment repositories. A malicious provider can be introduced outside the root module that an operator normally reviews.
How to check Go projects
Search go.mod, go.sum, vendored dependency trees and build metadata for:
gocommunity.io/orderedbtreegogets.dev/btreex
Aikido says gogets.dev/btreex used forged historical commits that caused Go module infrastructure to display misleading older dates. Dependency provenance and the exact module name are therefore stronger signals than an apparently old publication timestamp.
For binaries or build artifacts produced on an affected host, rebuild from a known-good dependency set after the host has been remediated and credentials have been rotated.
Response steps for an affected workstation or CI runner
- Isolate the system. Restrict network access while preserving evidence needed for investigation.
- Record the dependency state. Preserve Terraform lockfiles, Go module metadata, CI logs and relevant process/network telemetry before cleanup.
- Remove the malicious dependency. Replace typosquatted or attacker-controlled packages with the intended trusted dependency only after verifying its source.
- Rotate reachable credentials. Prioritize Git hosting tokens, cloud credentials, Terraform-related secrets, SSH keys, package-registry credentials and CI/CD secrets that were available to the affected account or process.
- Review source-control and cloud activity. Check for unauthorized commits, workflow changes, token use, infrastructure changes and new credentials during the exposure window.
- Rebuild from trusted state. Recreate CI runners or developer environments where practical instead of relying solely on package removal.
- Audit adjacent projects. Shared caches, reusable CI images and organization-wide dependency templates can propagate a bad dependency beyond the first repository where it was noticed.
Aikido explicitly recommends considering a machine compromised when one of the identified packages or providers was installed. Credential rotation should be scoped to what the host could actually access, with priority given to secrets capable of changing source code, publishing packages or modifying production infrastructure.
Registry compromise versus malicious packages
The published evidence identifies attacker-controlled or typosquatted packages distributed through normal ecosystem channels. It does not establish a compromise of HashiCorp's Terraform Registry platform itself. The operational issue is dependency trust: a provider can be available through a legitimate registry while the provider package is malicious.
The Hacker News independently reported the same four package names and Graphalgo linkage on September 23. Its coverage also describes the Terraform providers as a new distribution vector observed in this campaign.
Bottom line
Terraform and Go users should search for the exact four names identified by Aikido. Presence of one on a developer workstation or CI runner warrants host-level incident response, credential rotation and review of source-control and infrastructure activity. For Terraform users, the highest-value spelling check is kreuzwenker/docker versus the legitimate kreuzwerker/docker provider.
Sources
- Aikido Security — Graphalgo campaign spreads to Terraform providers and Go Modules: https://www.aikido.dev/blog/graphalgo-terraform-go-modules
- The Hacker News — Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry: https://thehackernews.com/2026/09/attackers-use-malicious-terraform.html