Go phantom package in our microservice — backdoor lived undetected for 6 months

Background

Large fintech. We use Go for our payment processing microservices. We use AI coding assistants heavily.

The Package

Sometime in Q2, a developer asked ChatGPT for help with HTTP client connection pooling. It suggested importing github.com/http-utils-go/client-pool.

The package existed on GitHub (2 stars, created 3 weeks prior). The code looked legitimate.

Six Months Later

Our SOC team detected anomalous outbound traffic from the payment service — small bursts of data every 4 hours. The destination: a CDN that was proxying to a C2 server.

The backdoor only activated in production (it checked for a PAYMENT_ env var prefix).

Impact

We cannot publicly disclose what was exfiltrated. Suffice to say: we had regulatory reporting obligations.

The developer who installed it was not at fault. They followed normal practice. Our package review process failed us.