--- title: Go malware hits Terraform providers, SIMD support keeps... description: This week's biggest story is security-focused: a Go malware campaign called Graphalgo spread through malicious Terraform providers and Go modules, marking the... canonical: https://daily.dev/posts/go-malware-hits-terraform-providers-simd-support-keeps-expanding-6dctf9swh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Go malware hits Terraform providers, SIMD support keeps expanding | daily.dev og:description: This week's biggest story is security-focused: a Go malware campaign called Graphalgo spread through malicious Terraform providers and Go modules, marking the... og:url: https://daily.dev/posts/go-malware-hits-terraform-providers-simd-support-keeps-expanding-6dctf9swh og:image: https://api.daily.dev/og/posts/6Dctf9swh.png og:image:alt: Go malware hits Terraform providers, SIMD support keeps expanding og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Go malware hits Terraform providers, SIMD support keeps expanding **[Go Digest](https://daily.dev/sources/golang_digest)** · 4 min read · 4 upvotes · 0 comments ## Summary This week's biggest story is security-focused: a Go malware campaign called Graphalgo spread through malicious Terraform providers and Go modules, marking the first systematic malware distribution through Terraform's ecosystem. On the language side, Go 1.27's portable SIMD package matured further, now covering AVX, NEON, and wasm behind one interface. A containerd 2.2 deep-dive found its new mount manager is slower than raw shell commands and panics under a specific mount configuration. Several new Go tools shipped this week, including a terminal UI engine built for AI agents and an event store designed to actually be deployable. ## Content **TLDR:** This week's biggest story is security-focused: a Go malware campaign called Graphalgo spread through malicious Terraform providers and Go modules, marking the first systematic malware distribution through Terraform's ecosystem. On the language side, Go 1.27's portable SIMD package matured further, now covering AVX, NEON, and wasm behind one interface. A containerd 2.2 deep-dive found its new mount manager is slower than raw shell commands and panics under a specific mount configuration. Several new Go tools shipped this week, including a terminal UI engine built for AI agents and an event store designed to actually be deployable. --- ## Graphalgo malware spreads through malicious Terraform providers and Go modules Researchers found a Go port of a known NPM malware campaign distributed via two malicious Terraform providers, one of them a typosquat of a provider with 56 million downloads, plus two fake Go modules hosted on lookalike sites like gogets.dev and gocommunity.io. The malware only activates under narrow conditions, like a matching SHA256 hash of Terraform variables, pointing to a targeted attack rather than mass distribution. A second-stage RAT talks to its operators over both Slack and an Ethereum smart contract on Arbitrum Sepolia, and the attackers backdated commit timestamps to dodge suspicion. This is the first known case of malware systematically riding through Terraform providers, which pushes the threat model past dev workstations and into infrastructure deployment credentials. [Read more](https://daily.dev/posts/HQi2wJ8y7) ## Go 1.27's portable SIMD package unifies AVX, NEON, and wasm Go 1.26 shipped an x86-only archsimd package; Go 1.27 adds arm64 NEON support plus a genuinely portable simd interface modeled on Google's Highway library that hides vector-width and instruction-set differences entirely. Where hardware SIMD isn't available, the package emulates the operation instead of failing, so the same code runs everywhere. Go 1.28 is slated to add Arm SVE support and more portable operations like ReduceSum and OnesCount. Worth watching if you write anything performance-sensitive in Go and have been avoiding hand-rolled fallback code for platforms without SIMD. [Read more](https://daily.dev/feed-by-ids?id=lDnl4GLB2&id=NVFOXnYsf&id=ymaT2HNb8) ## containerd 2.2's new mount manager is slower than raw shell commands and can panic A benchmark found manual shell commands beat containerd 2.2's bundled Activate() call on every single run, 23-26ms versus 30-47ms, because the manager shells out to the same mkfs binaries anyway and adds BoltDB bookkeeping on top. Worse, activating a single transform-only mount with nothing consuming its output triggers a reproducible index-out-of-range panic. Crash recovery only works if Activate already returned successfully; a crash mid-call leaves an orphaned loop device with no record to clean it up. If you're running containerd 2.2 in production, this is worth reading before you hit it live. [Read more](https://daily.dev/posts/U2xOfSPP8) --- ## Also notable - **Limoni brings zero-allocation TUI rendering with built-in AI-agent driving:** The Go terminal UI library claims zero heap allocations per frame and sub-microsecond diffing against Ratatui and Bubble Tea, and ships an MCP server so agents like Claude Code can drive the UI by widget role instead of screen coordinates. [Read more](https://daily.dev/posts/GThv8SZ15) - **TamarackDB packages an event store as a deployable SQLite-backed HTTP service:** It follows the Dynamic Consistency Boundary spec, uses SQLite's single-writer WAL mode as a deliberate constraint for modest-throughput apps, and persists versioned projections atomically alongside events in the same transaction, closing the usual eventual-consistency gap. [Read more](https://daily.dev/posts/9HH6Y6ajf) - **Grut bundles a Git-and-GitHub terminal file explorer with AI chat:** Built on Bubble Tea v2 and Cobra, it syncs file tree, commits, and PR previews in reactive panels and adds an AI chat panel powered by GitHub Copilot, all installable via go install. [Read more](https://daily.dev/posts/PUw9tfPLf) - **Go Weekly rounds up a batch of dependency version bumps:** NATS Server 2.15 defaults to a 1,000 consumer limit, garble 0.18 now requires Go 1.27 and builds 10-15% faster, and Terratest 2.0 splits into 16 separate modules. [Read more](https://daily.dev/posts/lDnl4GLB2) ## Similar posts on daily.dev - [Graphalgo Malware Spreads to Terraform and Go](https://daily.dev/posts/graphalgo-malware-spreads-to-terraform-and-go-hqi2wj8y7) · Aikido Security · 5 upvotes · 1 comments - [Malicious Go Module Exposes GitHub Malware Lure Network Span...](https://daily.dev/posts/malicious-go-module-exposes-github-malware-lure-network-span--fqwgrwl88) · Socket · 14 upvotes · 0 comments - [Issue \#619: Go 1.27's portable SIMD — Go Weekly](https://daily.dev/posts/issue-619-go-1-27-s-portable-simd-go-weekly-ldnl4glb2) · Golang Weekly · 4 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#golang](https://daily.dev/tags/golang), [#containers](https://daily.dev/tags/containers), [#terraform](https://daily.dev/tags/terraform) [View this post on daily.dev](https://daily.dev/posts/go-malware-hits-terraform-providers-simd-support-keeps-expanding-6dctf9swh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/go-malware-hits-terraform-providers-simd-support-keeps-expanding-6dctf9swh","headline":"Go malware hits Terraform providers, SIMD support keeps expanding","text":"This week's biggest story is security-focused: a Go malware campaign called Graphalgo spread through malicious Terraform providers and Go modules, marking the first systematic malware distribution through Terraform's ecosystem. On the language side, Go 1.27's portable SIMD package matured further, now covering AVX, NEON, and wasm behind one interface. A containerd 2.2 deep-dive found its new mount manager is slower than raw shell commands and panics under a specific mount configuration. Several new Go tools shipped this week, including a terminal UI engine built for AI agents and an event store designed to actually be deployable.","url":"https://daily.dev/posts/go-malware-hits-terraform-providers-simd-support-keeps-expanding-6dctf9swh","datePublished":"2026-09-28T04:17:44.372Z","dateModified":"2026-09-28T04:18:05.126Z","author":{"@type":"Organization","name":"Go Digest","logo":"https://media.daily.dev/image/upload/s--8Aro536C--/f_auto,q_auto/v1773839403/logos/golang_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/golang_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/golang_digest","name":"Go Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Go Digest","item":"https://daily.dev/sources/golang_digest"},{"@type":"ListItem","position":3,"name":"Go malware hits Terraform providers, SIMD support keeps expanding"}]} ```