Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

First time I’ve seen the Terraform Registry used as a malware delivery channel. Two malicious providers - kreuzwenker/docker with 1,449 downloads and gocommunity-io/dockerd with 222 - plus two Go modules carried Go malware that takes orders over Ethereum Sepolia smart contracts and Slack. Dual C2, so blocking one channel buys you nothing. Aikido and ReversingLabs link it to the DPRK-tied Graphalgo campaign.