The Terraform registry has its first reported malware, and it is the patient kind. Aikido reported on Tuesday that two providers, kreuzwenker/docker and gocommunity-io/dockerd, carry a Go implant in internal/provider/resource_docker_container_funcs.go. The first is a typosquat of kreuzwerker/docker, the Docker provider with about 57 million downloads. The second sits in the attacker’s own namespace.
Neither provider does anything on install. The payload activates only when the SHA256 hash of two of your variables, containerName and networkID, concatenated, equals one hardcoded value. That hash then works as an AES key for a file shipped inside the provider that pretends to be a SQLite import file, and the decrypted contents run detached from the Terraform process.
What runs is a Go remote-access tool with two command channels: a Slack bot and a smart contract on the Ethereum Arbitrum Sepolia testnet. It polls the blockchain every three seconds and Slack every ten, executes commands as further Go or JavaScript, or deletes itself. The same campaign also shipped through two Go modules, gogets.dev/btreex and gocommunity.io/orderedbtree; the first hides its payload in a ZIP dressed as a SQL file and waits for a specific price integer, and its repository carries forged commits backdated to November 2025, which the Go module proxy faithfully displays.
The scale so far is small. Aikido counted 18 hostnames from the malware’s check-ins, ten macOS, five Linux, three Windows, all of it part of the Graphalgo campaign first reported in February. On Wednesday night both providers were still in the registry, and kreuzwenker/docker had a fresh version published overnight: 1,463 downloads on the squat, against 57 million on the provider it is imitating.
If you might have run them
Grep your lock files and module caches for the two provider addresses and the two module paths. A plan that only ever ran with different variable values stayed inert. If either provider executed on a machine, Aikido’s advice is isolate, rotate every credential that touched it, and reimage; deleting the provider is not enough when the second stage was started detached.
My read
The vector matters more than the implant. Aikido says this is the first systematic malware distribution through Terraform it is aware of, and that it does not monitor the registry yet. For now the namespace is the security control: a typosquat sits next to the real provider, nothing else tells them apart, and this payload counted on exactly that.
Sources: Aikido’s write-up; provider and version metadata read from the public registry API on Wednesday night; the Go module proxy entries; Averlon’s earlier note on malicious Terraform providers as a vector