The phantom module that survived our code review

The Import

import "github.com/secure-go/jwt-utils" — ChatGPT suggested it for JWT signing. Looked official. Even had a plausible org name.

The Reality

The module existed. Two stars. Created two weeks prior. The Parse function had a subtle backdoor: any token with a specific kid header was accepted as valid, bypassing signature verification.

How Long

Six months in production. Our auth was wide open to anyone who knew the kid value.

Lesson

Go modules look authoritative because of the domain-style paths. Verify the repo. Check the stars. Read the code. Always.