Poisoned Code: Stealthy Malicious Go Module Backdoor Discovered in Long-Running Typosquat

Socket’s Threat Research Team discovered a typosquatted Go module (`github.com/shopsprint/decimal`) that impersonated the popular `github.com/shopspring/decimal` library. The attacker published benign updates for years, then weaponized the module (v1.3.3, 2023-08-19) to run a stealthy DNS TXT-based backdoor: an init() goroutine polls a hardcoded subdomain every five minutes and executes returned TXT record strings via exec.Command, enabling arbitrary remote code execution on any system that imports the package and posing high risk to developer machines, CI/CD pipelines, and production infrastructure.