Hackers Use Single-Letter Go Module Typosquat to Deploy DNS-Based Backdoor

A typosquatted Go module, github.com/shopsprint/decimal (v1.3.3), impersonating the legitimate shopspring/decimal library contains an init() function that opens a DNS TXT‑based command-and-control channel (dnslog-cdn-images.freemyip.com), beacons every five minutes, executes OS commands, and persists due to Go module proxy caching; IoCs including commit and file hashes and the C2 domain are provided and immediate remediation (audit, rotate credentials, monitor DNS) is recommended.