Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor

Reported 20 May 2026 by otx · Severity: medium

A long-running typosquatting campaign impersonated the widely used shopspring/decimal Go library by publishing github.com/shopsprint/decimal, differing by a single character. Active since November 2017, the package remained benign through seven releases until being weaponized in