Go shopspring/decimal library hit by 33-month undetected typosquat with DNS C2

Socket's Threat Research Team discovered a long-running typosquat of the popular Go library github.com/shopspring/decimal, published as github.com/shopsprint/decimal (swapping 'g' for 't'). The malicious module existed benignly since 2017 before being weaponized in August 2023 with version v1.3.3, which added an init() function that opens a DNS TXT record-based command-and-control channel. The C2 polls a free dynamic DNS subdomain every five minutes and executes any command returned as a TXT record via os/exec.Command. Despite the GitHub repository and owner account being deleted, the malicious release remains permanently cached and fetchable via proxy.golang.org. The attack went undetected for approximately 33 months. Developers are advised to audit go.mod files for the typosquatted path, replace it with the canonical library, and treat any affected build hosts as compromised. Security teams should sinkhole the C2 domain and baseline DNS TXT queries from build infrastructure.

Trail of Bits releases gosentry, a Go toolchain fork with LibAFL-powered fuzzing

Google Genkit ships composable middleware for Go agentic apps

Google’s open-source Genkit framework now ships a composable middleware system for TypeScript, Go, and Dart, with Python support on the way.
The system adds hooks at three layers of the tool execution loop:
<ul>
<li>Generate – conversation-level logic</li>
<li>Model – retries, fallbacks, and quota handling</li>
<li>Tool – approvals, sandboxing, and filesystem restrictions</li>
</ul>
These layers let you intercept what’s happening at each stage and apply your own logic before or after execution.
<h2>What comes out of the box</h2>
Genkit ships several pre-built middleware options:
<ul>
<li>Retries with exponential backoff – handles transient failures without manual wiring</li>
<li>Model fallbacks – automatically switches to an alternative provider when a quota is exceeded</li>
<li>Tool approval gates – adds human-in-the-loop checkpoints before a tool runs</li>
<li>Skill injection – pulls context from <code>SKILL.md</code> files into the agent’s workflow</li>
<li>Scoped filesystem access – restricts which paths an agent can read or write</li>
</ul>
Custom middleware follows a straightforward name-plus-factory contract. You can stack multiple middleware in explicit order, so the execution sequence is predictable. A content filter example in the docs shows how to enforce business rules deterministically in roughly 20 lines of Go.
<h2>Why this matters</h2>
Agentic applications have a reliability problem that prompt engineering alone can’t fix. When an agent is calling tools, hitting external APIs, and making decisions across multiple steps, you need infrastructure-level controls — not just better prompts. Middleware gives you a place to put that logic without tangling it into your core application code.
The Genkit Developer UI supports inspecting and tracing middleware execution, which helps when something goes wrong at 3am and you need to figure out which layer dropped the ball.
Full documentation is available in the Genkit docs.

Google's Genkit framework now includes a composable middleware system supporting TypeScript, Go, and Dart (Python coming soon). The system adds interception hooks at three layers: Generate (conversation-level), Model (retries, fallbacks, quota), and Tool (approvals, sandboxing, filesystem). Pre-built middleware includes exponential backoff retries, model fallbacks, human-in-the-loop tool approval gates, skill injection from SKILL.md files, and scoped filesystem access. Custom middleware follows a simple name-plus-factory pattern and can be stacked in explicit order. The Genkit Developer UI supports tracing middleware execution for debugging.

Go 1.25 and 1.26 ship container-aware GOMAXPROCS and Green Tea GC

Go 1.25 and 1.26 introduce four production-impacting features. Container-aware GOMAXPROCS automatically reads cgroup CPU limits at startup, eliminating Kubernetes CPU throttling that caused up to 890ms p99 latency in misconfigured pods. The Flight Recorder provides a circular buffer for continuous execution tracing, enabling post-incident forensics without needing to reproduce issues. The Green Tea garbage collector replaces object-centric mark-and-sweep with a page-centric design, delivering 10–40% reduction in GC CPU overhead and up to 18% p99 latency improvement, at the cost of 8–15% higher baseline RSS. Finally, an official Go MCP SDK positions Go as a first-class language for building AI agent infrastructure. Teams are advised to remove manual GOMAXPROCS overrides, recalibrate Kubernetes memory limits after upgrading, and test Green Tea before the opt-out disappears in Go 1.27.