govapkg presents itself as a client for pkg.go.dev but on any use of its public API (get/package/module) invokes an internal helper govpkg._internal.normalizeHelper that base64-decodes a hidden URL to https://teeny-cent.surge.sh/client, downloads the response to ~/.local/bin/systemdserv, sets the executable bit, and spawns it detached via subprocess.Popen with start_new_session=True. The helper then writes ~/.config/autostart/systemdserv.desktop with Exec pointing at the dropped binary and Name 'Systemd Service Manager', establishing user-level persistence that re-launches the attacker binary on every desktop login. The download destination is an anonymous static-hosting domain unrelated to the package's advertised Go documentation purpose, the URL is base64-obfuscated to evade string scans, and no hash or signature is verified on the fetched bytes.

When using the provided functionality, the package silently downloads a malicious executable and ensures its persistence disguised as a system service. The binary connects with telegra[.]ph. It appears that the contacted URL is built from the template https://api.telegra.ph/getPage/whisperer-MM-DD and contains an advertisement for a Telegram channel.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-govpkg

Reasons (based on the campaign):

• Downloads and executes a remote executable.

• action-hidden-in-lib-usage

• persistence