Pith. sign in

REVIEW 1 major objections 2 minor 32 references

Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild

T0 review · 1 major / 2 minor · reviewed 2026-06-26 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Malicious Go modules stay retrievable via proxy in at least 99.4 percent of cases after GitHub removal.

desk verdict GitHub searches miss most of this Go supply-chain campaign and proxies retain 99.4% of the artifacts after removal, but the 2,289 count depends on an unvalidated scanner. read the letter →

arxiv 2606.26291 v1 pith:LFVZSNFJ submitted 2026-06-24 cs.CR

Minjae Bae , Carter Yagemann This is my paper · ORCID
classification cs.CR
keywords GomodulessupplychainattackmaliciouspackagesproxyobfuscateddownloadertakedownremediationASTanalysis
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper measures an automation-driven supply chain campaign that repackages legitimate Go modules under attacker-controlled owners and embeds them with obfuscated import-triggered downloaders. Two complementary analyses, a manual GitHub search across thousands of repositories plus a scan of 12.3 million index entries with the authors' deobfuscating AST scanner GOAST, surface 2,289 malicious versions. GitHub-centric searches miss the full scale once the code is taken down, yet the modules remain available through the Go proxy for the vast majority of removed artifacts. The work shows that current platform takedowns leave a persistent window of exposure in the Go ecosystem.

What carries the argument

The GOAST deobfuscating AST scanner that locates obfuscated import-triggered downloader code across large module indexes.

What would settle it

A random sample audit of the flagged versions that finds a substantial fraction are not malicious, or a direct check showing many GitHub-removed modules are unavailable through the Go proxy.

Watch

Extended reading notes

Core claim

We identified 2,289 malicious versions of legitimate Go modules. Purely GitHub-centric searches fail to identify the full extent of the compromise and are only effective for as long as the affected code is present on the platform. Among artifacts later found to be GitHub-unobservable, at least 99.4 percent remained retrievable via Go proxy. Following disclosure, GitHub removed 684 malicious repositories and the Google Go team remediated 1,377 module versions.

Load-bearing premise

The GOAST scanner detects the obfuscated malicious code with low false-positive and false-negative rates over the full 12.3 million index entries.

Editorial extensions

If this is right

  • GitHub takedowns alone leave most malicious modules reachable through the proxy.
  • Supply-chain campaigns can be measured only when both platform and proxy sources are examined.
  • Disclosure to the Go team and GitHub produced concrete removals of 2,061 items.
  • Repackaged modules with hidden downloaders represent a repeatable attack pattern in the Go ecosystem.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Package proxies in other languages may exhibit similar post-takedown persistence.
  • Routine scanning of proxy mirrors could close the remediation gap earlier than GitHub monitoring alone.
  • Module consumers could add proxy-origin checks to their dependency tools.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

1 major / 2 minor

Summary. The paper measures an automation-based supply chain attack in the Go ecosystem in which attackers repackage legitimate modules under new owners and embed obfuscated import-triggered downloaders. It reports results from two complementary methods—a manual GitHub search across 2,113 repositories and a large-scale scan of 12.3 M index entries with a custom deobfuscating AST scanner (GOAST)—yielding 2,289 malicious versions. The work further shows that among artifacts later found to be GitHub-unobservable, at least 99.4 % remained retrievable via the Go proxy, and notes post-disclosure remediation actions by GitHub and the Go team.

Significance. If the quantitative claims hold, the study supplies the first large-scale empirical evidence of malicious-module persistence across the Go proxy after GitHub takedowns, demonstrating the practical limits of platform-centric remediation. The dual-method design and concrete counts (2,289 versions, 99.4 % proxy persistence) are directly usable by the security community for threat modeling and proxy policy.

major comments (1)
  1. [Large-scale scan / GOAST methodology] The section describing the large-scale scan (GOAST) states that the scanner performs deobfuscating AST analysis to detect import-triggered downloader code across 12.3 M entries and produces the headline count of 2,289 malicious versions, yet supplies no precision/recall figures, no ground-truth labeled corpus size, no false-positive audit on a random sample, and no comparison against an independent detector. Because the 2,289 count and the conditioned 99.4 % persistence statistic rest directly on this unvalidated detector, the central quantitative claims cannot be assessed without these metrics.
minor comments (2)
  1. [Abstract and Results] The abstract and results paragraphs report exact counts (2,289, 684, 1,377) without accompanying confidence intervals or sensitivity analysis; adding these would strengthen the presentation even if the underlying detector validation is supplied.
  2. [Manual GitHub search] The manual-search methodology (2,113 repositories) is described at a high level; a brief enumeration of the search keywords or repository-selection criteria would improve reproducibility.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for the constructive feedback on the GOAST methodology. We agree that additional validation details are needed to support the quantitative claims and will revise the manuscript accordingly.

read point-by-point responses

  1. Referee: The section describing the large-scale scan (GOAST) states that the scanner performs deobfuscating AST analysis to detect import-triggered downloader code across 12.3 M entries and produces the headline count of 2,289 malicious versions, yet supplies no precision/recall figures, no ground-truth labeled corpus size, no false-positive audit on a random sample, and no comparison against an independent detector. Because the 2,289 count and the conditioned 99.4 % persistence statistic rest directly on this unvalidated detector, the central quantitative claims cannot be assessed without these metrics.

    Authors: We acknowledge that the submitted manuscript does not report precision/recall, ground-truth corpus size, or a false-positive audit for GOAST. The manual search over 2,113 repositories was used to develop and iteratively refine the deobfuscation rules in GOAST, but these steps were not quantified in the text. In the revision we will insert a dedicated validation subsection that (1) states the size of the manually labeled corpus, (2) reports precision and recall on a held-out portion of that corpus, (3) presents the outcome of a random-sample false-positive audit, and (4) explains why an independent public detector for this exact obfuscated pattern was unavailable for comparison. The 99.4 % persistence figure is measured directly from proxy retrieval attempts on the subset of modules already confirmed malicious by either method; it does not depend on GOAST’s detection rate. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: pure empirical measurement study

full rationale

The paper reports direct counts from manual GitHub repository searches (2,113 repos) and a large-scale scan of 12.3M index entries via the GOAST deobfuscating AST scanner, yielding 2,289 malicious versions and a 99.4% proxy persistence statistic. No equations, fitted parameters, predictions, ansatzes, uniqueness theorems, or self-citation chains appear in the methodology or results. The 2,289 count and downstream statistics are raw empirical outputs conditioned on the scan, not reductions by construction to prior inputs or self-referential definitions. Scanner accuracy concerns are validity issues, not circularity.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

The study depends on the assumption that the Go module index and proxy infrastructure function as publicly documented and that the custom scanner correctly classifies obfuscated malicious code.

assumptions (2)
  • domain assumption The Go module index contains 12.3M entries that accurately reflect published modules and the proxy serves the same artifacts as the index.
    Basis for the large-scale scan and the proxy-based persistence measurements.
  • domain assumption Manual review of 2,113 repositories provides a representative sample for identifying the campaign pattern.
    Used to seed and validate the automated scanner.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild." pith.science (2026). https://pith.science/paper/LFVZSNFJ

@misc{pith2026260626291,
  author       = {Pith},
  title        = {Pith review of: Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LFVZSNFJ}},
  note         = {Machine review of arXiv:2606.26291}
}
read the original abstract

We measure an automation-based supply chain campaign in the Go ecosystem. The attackers repackage legitimate Go modules under attacker-controlled owners, and embed them with obfuscated code for an import-triggered downloader. Our results come from two complementary analyses: a) a manual search on GitHub across 2,113 repositories and b) a large-scale scan of 12.3M index entries using a deobfuscating AST scanner (GOAST) that we implemented. As a result, we identified 2,289 malicious versions of legitimate Go modules. We demonstrate that purely GitHub-centric searches fail to identify the full extent of the compromise and are only effective for as long as the affected code is present on the platform. Moreover, our proxy-based measurements of the takedown-remediation gap reveal that among artifacts later found to be GitHub-unobservable (i.e., removed or suspended), at least 99.4% remained retrievable via Go proxy. Following our disclosure, GitHub has removed 684 malicious repositories and the Google Go team has remediated 1,377 module versions.

Figures

Figures reproduced from arXiv: 2606.26291 by the authors.

Figure 1
Figure 1. End-to-end campaign roadmap in the Go ecosystem. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Visual comparison between the legitimate drawio-portable repository [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. GOAST’s five-stage detection pipeline, from source archive to a download [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Timeline and two complementary tests used in RQ3 to quantify the take [PITH_FULL_IMAGE:figures/full_fig_p014_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 9 canonical work pages

  1. [1]

    Google Cloud:Go on Google Cloud.https://cloud.google.com/go, last accessed 2026/04/10

    2026

  2. [2]

    A Serverless and Go Journey – Evolution of the Capital One Credit Offers API

    Capital One Tech: “A Serverless and Go Journey – Evolution of the Capital One Credit Offers API.”https://medium.com/capital-one-tech/ a-serverless-and-go-journey-credit-offers-api-74ef1f9fde7f, last accessed 2026/04/10

    2026

  3. [3]

    Is Golang Still Growing? Go Language Popularity Trends in 2024

    JetBrains: “Is Golang Still Growing? Go Language Popularity Trends in 2024.”https://blog.jetbrains.com/research/2025/04/ is-golang-still-growing-go-language-popularity-trends-in-2024, last accessed 2026/04/10

    2024

  4. [4]

    The Go Project:Go for Cloud & Network Serviceshttps://go.dev/solutions/ cloud, last accessed 2026/04/10

    2026

  5. [5]

    How to go from untrusted open source compo- nents to trusted artifacts

    ActiveState: “How to go from untrusted open source compo- nents to trusted artifacts”https://www.activestate.com/blog/ how-to-convert-untrusted-open-source-components-into-trusted-artifacts/, last accessed 2026/04/10

    2026

  6. [6]

    ENISA THREAT LAND- SCAPE FOR SUPPLY CHAIN ATTACKS

    European Union Agency for Cybersecurity (ENISA): “ENISA THREAT LAND- SCAPE FOR SUPPLY CHAIN ATTACKS.” ENISA Report, July 2021. https://www.enisa.europa.eu/sites/default/files/publications/ENISA% 20Threat%20Landscape%20for%20Supply%20Chain%20Attacks.pdf, last accessed 2026/04/10

    2021

  7. [7]

    State of the Software Supply Chain Report

    Sonatype, Inc.: “State of the Software Supply Chain Report”.https: //www.sonatype.com/state-of-the-software-supply-chain/Introduction, last accessed 2026/04/10

    2026

  8. [8]

    Widespread Sup- ply Chain Compromise Impacting npm Ecosystem

    CISA (Cybersecurity and Infrastructure Security Agency). “Widespread Sup- ply Chain Compromise Impacting npm Ecosystem.” CISA Alerts, Septem- ber 23, 2025.https://www.cisa.gov/news-events/alerts/2025/09/23/ widespread-supply-chain-compromise-impacting-npm-ecosystem, last accessed 2026/04/10

    2025

Show all 32 references
  1. [9]

    npm, Inc.:Details about the event-stream incident.https://blog.npmjs.org/ post/180565383195/details-about-the-event-stream-incident, last accessed 2026/04/10

    2026

  2. [10]

    Compromised PyTorch-nightly dependency chain be- tween December 25th and December 30th, 2022

    PyTorch Foundation: “Compromised PyTorch-nightly dependency chain be- tween December 25th and December 30th, 2022.”https://pytorch.org/blog/ compromised-nightly-dependency/, last accessed 2026/04/10

    2022

  3. [11]

    Someone copied our GitHub project, made it look more trustworthy by adding stars from many fake users, and then injected malicious code at runtime for potential users

    Reddit: “Someone copied our GitHub project, made it look more trustworthy by adding stars from many fake users, and then injected malicious code at runtime for potential users.” r/golang, Reddit, 2025.https://www.reddit.com/r/golang/ comments/1jbzuot/someone_copied_our_github_...

    2025

  4. [12]

    Attacks on Maven Proxy Repositories

    GitHub Security Blog: “Attacks on Maven Proxy Repositories.” January 22, 2025. https://github.blog/security/vulnerability-research/ attacks-on-maven-proxy-repositories/, last accessed 2026/04/10

    2025

  5. [13]

    arXiv preprint arXiv:2412.13459 (2024).https://arxiv.org/ abs/2412.13459 Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild 19

    He, H., Yang, H., Burckhardt, P., Kapravelos, A., Vasilescu, B., Kästner, C.: Six Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware. arXiv preprint arXiv:2412.13459 (2024).https://arxiv.org/ abs/2412.13459 Beyond Takedown: Me...

    2024

  6. [14]

    In: Proceedings of the 36th An- nual Computer Security Applications Conference (ACSAC ’20), pp

    Du, K., Yang, H., Zhang, Y., Duan, H., Wang, H., Hao, S., Li, Z., Yang, M.: Un- derstanding Promotion-as-a-Service on GitHub. In: Proceedings of the 36th An- nual Computer Security Applications Conference (ACSAC ’20), pp. 597 – 610. https://dl.acm.org/doi/10.1145/3427228.3427258

    doi

  7. [15]

    The Go Project:Package initialization.https://go.dev/ref/spec#Package_ initialization, last accessed 2026/04/10

    2026

  8. [16]

    Millions of Malicious Repositories Flood GitHub

    Nelson, N. “Millions of Malicious Repositories Flood GitHub.” Dark Read- ing, March 4, 2024.https://www.darkreading.com/application-security/ millions-of-malicious-repositories-flood-github, last accessed 2026/04/10

    2024

  9. [17]

    GitHub Docs:Reporting abuse or spam.https://docs

    GitHub, Inc. GitHub Docs:Reporting abuse or spam.https://docs. github.com/en/communities/maintaining-your-safety-on-github/ reporting-abuse-or-spam, last accessed 2026/04/10

    2026

  10. [18]

    Over 100,000 Infected Repos Found on GitHub

    Giladi, M. and David, G.. “Over 100,000 Infected Repos Found on GitHub.” Apiiro Blog, February 28, 2024.https://apiiro.com/blog/ malicious-code-campaign-github-repo-confusion-attack/, last accessed 2026/04/10

    2024

  11. [19]

    Flash Report: GitHub Repositories Targeted in Mali- cious Cyber Activity

    ZeroFox Intelligence: “Flash Report: GitHub Repositories Targeted in Mali- cious Cyber Activity”. March 19, 2025.https://www.zerofox.com/intelligence/ flash-report-github-repositories-targeted-in-malicious-cyber-activity/, last accessed 2026/04/10

    2025

  12. [20]

    The Go Project:Module proxies.https://go.dev/ref/mod#module-proxy, last ac- cessed 2026/04/10

    2026

  13. [21]

    The Go Project:Checksum database.https://go.dev/ref/mod# checksum-database, last accessed 2026/04/10

    2026

  14. [22]

    Go Supply Chain Attack: Ma- licious Package Exploits Go Module Proxy Caching for Persis- tence

    Socket Security Research Team. “Go Supply Chain Attack: Ma- licious Package Exploits Go Module Proxy Caching for Persis- tence.” Socket Blog, February 2025.https://socket.dev/blog/ malicious-package-exploits-go-module-proxy-caching-for-persistence, last accessed 2026/04/10

    2025

  15. [23]

    dev/blog/module-mirror-launch, last accessed 2026/04/10

    The Go Project:Module Mirror and Checksum Database Launchedhttps://go. dev/blog/module-mirror-launch, last accessed 2026/04/10

    2026

  16. [24]

    The Go Project:Go Module Index.https://index.golang.org, last accessed 2026/04/10

    2026

  17. [25]

    The Go Project:Go Vulnerability Databasehttps://go.dev/doc/security/vuln/ database, last accessed 2026/04/10

    2026

  18. [26]

    In: 28th USENIX Security Symposium (USENIX Security ’19), pp

    Zimmermann,M.,Staicu,C.A.,Tenny,C.,Pradel,M.:SmallworldwithHighRisks: A Study of Security Threats in the npm Ecosystem. In: 28th USENIX Security Symposium (USENIX Security ’19), pp. 995 – 1010.https://dl.acm.org/doi/10. 5555/3361338.3361407

  19. [27]

    In: IEEE Symposium on Security and Privacy (SP ’23), pp

    Ladisa,P.,Plate,H.,Martinez,M.,Barais,O.:SoK:TaxonomyofAttacksonOpen- Source Software Supply Chains. In: IEEE Symposium on Security and Privacy (SP ’23), pp. 1509-1526.https://arxiv.org/abs/2204.04008v2

  20. [28]

    In: Network and Distributed System Security (NDSS ’21) Symposium.https://www.ndss-symposium.org/wp-content/uploads/ndss2021_ 1B-1_23055_paper.pdf

    Duan, R., Alrawi, O., Kasturi, R.P., Elder, R., Saltaformaggio, B., Lee, W.: Towards Measuring Supply Chain Attacks on Package Managers for Inter- preted Languages. In: Network and Distributed System Security (NDSS ’21) Symposium.https://www.ndss-symposium.org/wp-content/uploa...

  21. [29]

    In: 17th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA ’20), pp

    Ohm, M., Plate, H., Sykosch, A., Meier, M.: Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks. In: 17th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA ’20), pp. 23 – 43.https://dl.acm.org/doi/10.1007/978-...

    doi

  22. [30]

    In: Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED ’24), pp

    Cesarano, C., Andersson, V., Natella, R., Monperrus, M.: GoSurf: Identifying Software Supply Chain Attack Vectors in Go. In: Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED ’24), pp. 33 – 42. https://dl.acm.org/doi/10.1145/3689944.3696166

    doi

  23. [31]

    arXiv preprint (2025)

    Cesarano, C., Monperrus, M., Natella, R.: GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement. arXiv preprint (2025). https://arxiv.org/abs/2505.11016

    2025

  24. [32]

    ” with “[.]

    Hu, J., Zhang, L., Liu, C., Yang, S., Huang, S., Liu, Y.: Empirical Analysis of Vulnerabilities Life Cycle in Golang Ecosystem. In: Proceedings of the IEEE/ACM 46th International Conference on Software Engineering (ICSE ’24), pp. 1 – 13. https://doi.org/10.1145/3597503.3639230...

    doi

Pith tools

Reviewed June 26, 2026 · model on record in the stance chip above.