MAL-2026-17454Critical▾ Abyssal⚠ Exploited in the wild

Malicious code in gogets.dev/btreex (Go)

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score70/ 100 · Elevated

impact 52.3 · likelihood 0 · exploitation 18

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 2, 2026

Updated

Oct 2, 2026

CVSS

—

Vendor

btreex

Product

gogets.dev/btreex

CWE

—

Depth score

70 · Elevated

EPSS

—

Platforms

—

Source

OSV

Vector

—

btreex #osv #go #malware

Affected

gogets.dev/btreex

Full technical detail▾

Overview

Part of the Graphalgo campaign. The module, first published around 2026-09-08, hides its payload in a ZIP archive disguised as a SQL file (btreex.sql). The payload is triggered when a specific price integer value is passed, and drops the same dual-channel RAT (Ethereum smart contract dead drop plus Slack bot token) used by gocommunity.io/orderedbtree.

Affected packages

gogets.dev/btreex

Remediation

Refer to the advisory for the patched release.

References

https://www.aikido.dev/blog/graphalgo-terraform-go-modules

#osv#go#malware