A Malicious Go Module Sat in the Mirror for 3 Years. Your go.sum Won't Save You

Book: Hexagonal Architecture in Go Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools Me: xgabriel.com | GitHub In February 2026, a Go module named github.com/xinfeisoft/crypto appeared on the public proxy. The name was chosen so a tired developer scanning their dependency tree would read past it. The source copied golang.org/x/cryp