The Dependency That Wasn't in Any Lockfile

We had a private module called internal-go-utils hosted on our internal Go proxy. It never existed on the public proxy — until it did. Someone registered a public module with the identical path, and because our CI runner's GOPROXY fell back to the public registry for anything not cached, it pulled the malicious version into a release build.

The public version looked identical but appended a tiny init() that read ~/.aws/credentials and exfiltrated it. We caught it during a routine audit when an unfamiliar user-agent hit our staging AWS account. By then the credentials had been live for three days.

The fix was painful: enforce GOFLAGS=-mod=vendor, set GOPRIVATE for every internal path, and never let the public proxy be a fallback. If your module name isn't reserved publicly, assume someone will take it.