`https://github.com/golangorg`

https://github.com/golangorg is a GitHub account that 4 published sources report in connection with Contagious Interview and IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Socket, NKInternet, Anonhaven and The Hacker News. The earliest of those reports is dated 2026-04-07 and the most recent 2026-10-18.

github profile Contagious Interview IT Worker Fraud CURATED removed checked 2026-09-02

Listed as golangorg

First seen 2026-04-07 · last seen 2026-10-18

removed checked 2026-09-02

Sources

GitHub account in the April 2026 cross-ecosystem Contagious Interview wave: the primary GitHub alias Socket names for the cluster, which published the formstash Go module and a Packagist package under the same name.
North Korea's Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads — Socket · published 2026-04-07 · pulled 2026-09-21
…That URL now redirects to github.com/golangorg/logger-base — a different GitHub account entirely.…
npm Malware, Fake Devs, and Deepfake Videos: These Are A Few of My Favorite DPRK Things | North Korean Internet — NKInternet · under “aokisasakidev” · published 2026-04-07 · pulled 2026-08-30
…In github.com/golangorg/formstash , the module is mostly a real multipart parser, but it also exposes a malicious helper that has no place in that codebase: Go…
North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads | Socket — Socket · under “Hiding Malware Behind Routine APIs #” · published 2026-04-07 · pulled 2026-09-12
…Registration email aokisasaki1122@gmail.com Registration email shiningup1996@gmail.com GitHub account github.com/golangorg GitHub account github.com/aokisasakidev GitHub account github.com/maxcointech1010 GitHub account…
Contagious Interview Hits npm, PyPI, Go, Rust, PHP — Anonhaven · under “Indicators of compromise” · published 2026-04-08 · pulled 2026-09-18
…logger-base, logkitx, pino-debugger, debug-fmt, debug-glitz PyPI: logutilkit, apachelicense, fluxhttp, license-utils-kit Go: github.com/golangorg/formstash, github.com/aokisasakidev/mit-license-pkg Rust: logtrace Packagist: golangorg/logkit These loaders are designed to fetch…
N. Korean Hackers Spread 1,700 Malicious Packages Across npm, PyPI, Go, Rust — The Hacker News · under “N. Korean Hackers Spread 1,700 Malicious Packages Across npm, PyPI, Go, Rust” · published 2026-04-08 · pulled 2026-09-18

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Cited by the same report: North Korea's Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads

Socket lists 27 other indicators in this source. 7 are shown, chosen across types.

All 28 indicators from this source

Cited by the same report: npm Malware, Fake Devs, and Deepfake Videos: These Are A Few of My Favorite DPRK Things | North Korean Internet

NKInternet lists 31 other indicators in this source. 5 are shown, chosen across types.

All 32 indicators from this source