Malicious Go Packages Mimic as Google’s UUID Library to Exfiltrate Sensitive Data

Security researchers uncovered a years‑long supply-chain typosquatting campaign targeting Go developers: two malicious packages (github.com/bpoorman/uuid and github.com/bpoorman/uid) impersonated popular UUID libraries and contained a backdoor Valid function that encrypts and silently exfiltrates input data to dpaste.com with a hardcoded API token; the packages persisted since May 2021 and were still accessible via pkg.go.dev or public mirrors, prompting recommendations to audit go.mod and verify imports.