Embedded Malicious Code Affecting github.com/vkuznet/gocurl package, versions =0.0.0-20261111095532-8d5aad0cb0da
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMVKUZNETGOCURL-22444973
- published12 Nov 2026
- disclosed11 Nov 2026
- creditUnknown
Introduced: 11 Nov 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the github.com/vkuznet/gocurl package.
Overview
Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious code is present in the affected versions of the package as injected CI helper code, either an npm postinstall hook or added GitHub Actions workflow steps. The code collects repository secrets, GitHub tokens, cloud credentials and other sensitive files and sends them to attacker-controlled servers. It also tries to create persistent access in AWS and Azure accounts reachable with the stolen credentials. The code runs only when npm install or npm ci is executed in the neuronai-studio package, or when a GitHub Actions run is triggered for the gocurl and redock workflows, and installing the Go modules does not execute it.