{"id":"c4c9475c-9012-432f-9c88-5e0dc90d9965","arxiv_id":"2606.26291","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Large-scale scan found 2,289 malicious Go module versions and showed 99.4% remained retrievable via proxy after GitHub takedowns.","lead":"Researchers used manual GitHub searches and a custom deobfuscating scanner on 12.3 million Go module entries to find 2,289 malicious repackaged versions with hidden downloaders. The work shows malicious modules often stay available through proxies long after GitHub removes them.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"GOAST scanner accuracy unvalidated at scale; 2,289 count rests on unquantified FP/FN rates","rationale":"The reader's weakest_assumption correctly isolates the scanner's reliability as the single point that must hold for the numerical claims to be credible. Because the full text (per the prompt) still provides no quantitative validation of GOAST, the concern remains load-bearing and the UNVERDICTED verdict is appropriate pending that evidence.","tokens_in":1702,"tokens_out":344,"duration_ms":8238,"concrete_test":"Extract the GOAST validation subsection (or equivalent) and report precision/recall on its labeled test set; independently implement a second static detector for the same obfuscation pattern and run both on a 10 k-entry random subsample of the index; if the two detectors disagree on >5 % of flagged modules, recompute the 2,289 figure using only the intersection.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The headline count of 2,289 malicious versions is produced by the large-scale GOAST scan over 12.3 M index entries. The method description states that GOAST performs deobfuscating AST analysis to detect import-triggered downloader code, yet the text supplies no precision/recall figures, no ground-truth labeled corpus size, no false-positive audit on a random sample of the 12.3 M entries, and no comparison against an independent detector. Without these, the reported total cannot be shown to be free of systematic over- or under-counting, directly undermining both the scale claim and the subsequent proxy-persistence statistic that is conditioned on the same set of artifacts.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper measures an automation-based supply chain attack in the Go ecosystem in which attackers repackage legitimate modules under new owners and embed obfuscated import-triggered downloaders. It reports results from two complementary methods—a manual GitHub search across 2,113 repositories and a large-scale scan of 12.3 M index entries with a custom deobfuscating AST scanner (GOAST)—yielding 2,289 malicious versions. The work further shows that among artifacts later found to be GitHub-unobservable, at least 99.4 % remained retrievable via the Go proxy, and notes post-disclosure remediation actions by GitHub and the Go team.","tokens_in":1835,"tokens_out":503,"duration_ms":13875,"significance":"If the quantitative claims hold, the study supplies the first large-scale empirical evidence of malicious-module persistence across the Go proxy after GitHub takedowns, demonstrating the practical limits of platform-centric remediation. The dual-method design and concrete counts (2,289 versions, 99.4 % proxy persistence) are directly usable by the security community for threat modeling and proxy policy.","major_comments":[{"comment":"The section describing the large-scale scan (GOAST) states that the scanner performs deobfuscating AST analysis to detect import-triggered downloader code across 12.3 M entries and produces the headline count of 2,289 malicious versions, yet supplies no precision/recall figures, no ground-truth labeled corpus size, no false-positive audit on a random sample, and no comparison against an independent detector. Because the 2,289 count and the conditioned 99.4 % persistence statistic rest directly on this unvalidated detector, the central quantitative claims cannot be assessed without these metrics.","section":"Large-scale scan / GOAST methodology"}],"minor_comments":[{"comment":"The abstract and results paragraphs report exact counts (2,289, 684, 1,377) without accompanying confidence intervals or sensitivity analysis; adding these would strengthen the presentation even if the underlying detector validation is supplied.","section":"Abstract and Results"},{"comment":"The manual-search methodology (2,113 repositories) is described at a high level; a brief enumeration of the search keywords or repository-selection criteria would improve reproducibility.","section":"Manual GitHub search"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback on the GOAST methodology. We agree that additional validation details are needed to support the quantitative claims and will revise the manuscript accordingly.","responses":[{"response":"We acknowledge that the submitted manuscript does not report precision/recall, ground-truth corpus size, or a false-positive audit for GOAST. The manual search over 2,113 repositories was used to develop and iteratively refine the deobfuscation rules in GOAST, but these steps were not quantified in the text. In the revision we will insert a dedicated validation subsection that (1) states the size of the manually labeled corpus, (2) reports precision and recall on a held-out portion of that corpus, (3) presents the outcome of a random-sample false-positive audit, and (4) explains why an independent public detector for this exact obfuscated pattern was unavailable for comparison. The 99.4 % persistence figure is measured directly from proxy retrieval attempts on the subset of modules already confirmed malicious by either method; it does not depend on GOAST’s detection rate.","revision_made":"yes","referee_comment":"The section describing the large-scale scan (GOAST) states that the scanner performs deobfuscating AST analysis to detect import-triggered downloader code across 12.3 M entries and produces the headline count of 2,289 malicious versions, yet supplies no precision/recall figures, no ground-truth labeled corpus size, no false-positive audit on a random sample, and no comparison against an independent detector. Because the 2,289 count and the conditioned 99.4 % persistence statistic rest directly on this unvalidated detector, the central quantitative claims cannot be assessed without these metrics."}],"tokens_in":1362,"tokens_out":372,"duration_ms":12235,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The paper's core finding is that a GitHub-only search catches only part of the malicious Go modules, while the Go proxy keeps at least 99.4% of the removed ones available. They report 2,289 malicious versions from two methods: manual review of 2,113 GitHub repos and a scan of 12.3 million index entries with their GOAST deobfuscating AST tool. After disclosure GitHub took down 684 repos and the Go team fixed 1,377 versions.\n\nThe dual-method design and the persistence number are the useful parts. Showing that platform takedowns leave most artifacts reachable through the proxy is a concrete measurement that matters for how proxies and registries coordinate. The fact that the work produced real removals also gives it some external grounding.\n\nThe main gap is validation of GOAST. The abstract states it detects obfuscated import-triggered downloaders but supplies no precision, recall, ground-truth corpus size, or random-sample audit on the 12.3 million entries. Without those numbers the 2,289 total and the 99.4% figure that depends on it cannot be checked for systematic over- or under-counting. That is the load-bearing assumption.\n\nThe paper is aimed at people who study supply-chain attacks in open-source ecosystems, especially Go. A reader who needs data on remediation gaps will find the numbers worth looking at even if the scanner details need more work.\n\nIt is worth sending to peer review. The claims are specific enough and the topic is timely; the validation issue is fixable with added experiments rather than a fundamental flaw in the setup.","headline":"GitHub searches miss most of this Go supply-chain campaign and proxies retain 99.4% of the artifacts after removal, but the 2,289 count depends on an unvalidated scanner.","tokens_in":2308,"tokens_out":416,"would_cite":false,"duration_ms":16499,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Malicious Go modules stay retrievable via proxy in at least 99.4 percent of cases after GitHub removal.","keywords":["Go modules","supply chain attack","malicious packages","Go proxy","obfuscated downloader","takedown remediation","AST analysis"],"falsifier":"A random sample audit of the flagged versions that finds a substantial fraction are not malicious, or a direct check showing many GitHub-removed modules are unavailable through the Go proxy.","tokens_in":2596,"feed_emoji":"","tokens_out":642,"duration_ms":14299,"temperature":0.7,"pith_summary":"The paper measures an automation-driven supply chain campaign that repackages legitimate Go modules under attacker-controlled owners and embeds them with obfuscated import-triggered downloaders. Two complementary analyses, a manual GitHub search across thousands of repositories plus a scan of 12.3 million index entries with the authors' deobfuscating AST scanner GOAST, surface 2,289 malicious versions. GitHub-centric searches miss the full scale once the code is taken down, yet the modules remain available through the Go proxy for the vast majority of removed artifacts. The work shows that current platform takedowns leave a persistent window of exposure in the Go ecosystem.","feed_headline":"Go proxy keeps 99.4% of removed malicious modules available","feed_subtitle":"Scan across 12.3M entries finds 2,289 repackaged versions with hidden downloaders that outlast GitHub removal.","key_machinery":"The GOAST deobfuscating AST scanner that locates obfuscated import-triggered downloader code across large module indexes.","core_discovery":"We identified 2,289 malicious versions of legitimate Go modules. Purely GitHub-centric searches fail to identify the full extent of the compromise and are only effective for as long as the affected code is present on the platform. Among artifacts later found to be GitHub-unobservable, at least 99.4 percent remained retrievable via Go proxy. Following disclosure, GitHub removed 684 malicious repositories and the Google Go team remediated 1,377 module versions.","pith_inferences":["Package proxies in other languages may exhibit similar post-takedown persistence.","Routine scanning of proxy mirrors could close the remediation gap earlier than GitHub monitoring alone.","Module consumers could add proxy-origin checks to their dependency tools."],"forward_implications":["GitHub takedowns alone leave most malicious modules reachable through the proxy.","Supply-chain campaigns can be measured only when both platform and proxy sources are examined.","Disclosure to the Go team and GitHub produced concrete removals of 2,061 items.","Repackaged modules with hidden downloaders represent a repeatable attack pattern in the Go ecosystem."],"fun_headline_variants":["Go proxy retains 99.4% of malicious modules after removal","2,289 malicious Go modules remain accessible via proxy","GitHub takedowns miss 99.4% of malicious modules in proxy","Malicious Go modules remain in proxy after GitHub removal"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The GOAST scanner detects the obfuscated malicious code with low false-positive and false-negative rates over the full 12.3 million index entries.","fun_headline_variants_meta":{"raw":{"variants":["Go proxy retains 99.4% of malicious modules after removal","2,289 malicious Go modules remain accessible via proxy","GitHub takedowns miss 99.4% of malicious modules in proxy","Malicious Go modules remain in proxy after GitHub removal"]},"model":"grok-4.3","cost_usd":0.007802,"raw_usage":{"total_tokens":3563,"prompt_tokens":669,"num_sources_used":0,"completion_tokens":71,"cost_in_usd_ticks":78024500,"prompt_tokens_details":{"text_tokens":669,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2823,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":669,"tokens_out":71,"duration_ms":20067,"temperature":1.0,"reasoning_tokens":2823,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-26T01:25:41.664892+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A random sample audit of the flagged versions that finds a substantial fraction are not malicious, or a direct check showing many GitHub-removed modules are unavailable through the Go proxy.","supporting_citations":[],"review_version":1}