A long-running typosquat of a popular Go decimal library was weaponized to include a DNS-based backdoor. The malicious package, github.com/shopsprint/decimal, uses an init() function to poll a dynamic DNS subdomain via TXT records, executing the returned strings as arbitrary commands on the host system.
DNS Backdoor
1 post
Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor