GopherCon 2025: The Code You Reviewed is Not the Code You Built - Jess McClintock

Why watch

This talk analyzes a real-world boltdb typosquat attack on the Go module proxy, where attackers modified git tags to hide malicious code. It demonstrates how even security-conscious developers reviewing code on GitHub can be deceived by the two-level attack: the typosquat itself and decoy code. Essential viewing for Go developers concerned about open source package security.