Socket: Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor

What it is

github.com/shopsprint/decimal — a single-character typosquat of github.com/shopspring/decimal (the widely-used Go fixed-point decimal library, 38,634 importers on pkg.go.dev). The typosquat swaps the final g for a t. Version v1.3.3 (published 2023-08-19 09:27:21 UTC) is trojanized; all earlier tags are clean copies of upstream.

How it works

Between v1.3.2 and v1.3.3 the attacker spliced three edits into decimal.go: added imports net, os/exec, time; a malicious init(); and an empty main() inside the package. Because it lives in init(), it runs at process start with no opt-in. A background goroutine calls net.LookupTXT("dnslog-cdn-images.freemyip.com") every 5 minutes and passes each returned TXT string straight to exec.Command(txt).CombinedOutput(). The full public API and arithmetic behavior are preserved, so the module compiles, passes tests, and produces correct results — the C2 loop never touches the arithmetic paths and emits no visible output.

Preconditions / Affected

Any Go project that fetches the shopsprint/decimal path — via a typo in go.mod, an import line, go get, or IDE autocomplete — and builds a binary. Financial, billing, crypto, and analytics codebases are the intended targets. The C2 requires outbound DNS resolution of the attacker subdomain to receive commands.

What to do

• Grep your modules and lockfiles for the typosquat path, not just the legit one:

grep -R "shopsprint/decimal" go.mod go.sum

• Compare against the legitimate package's import set — the real shopspring/decimal imports only database/sql/driver, encoding/binary, fmt, math, math/big, regexp, strconv, strings, and has no net, os/exec, or init(). Presence of those is the tell.
• Block/alert on DNS resolution of dnslog-cdn-images[.]freemyip[.]com.
• Note that removal at source does not remediate: the GitHub repo and shopsprint owner account are deleted, but proxy.golang.org permanently caches and serves v1.3.3 on demand. Fixing this requires purging the dependency, not waiting for takedown.

Caveats

• The page states public adoption signals for the typosquat itself are limited — impact depends on whether anyone actually pulled it, which the report does not quantify.
• The "trust-then-poison" timing (benign v1.3.2 and malicious v1.3.3 seven minutes apart) is behavioral inference; only v1.3.3 is confirmed weaponized.
• Roughly six years benign then ~33 months weaponized in the open ecosystem before disclosure.