{
  "title": "shopsprint/decimal Go Module DNS Backdoor Typosquat",
  "summary": "The Go module github.com/shopsprint/decimal typosquatted github.com/shopspring/decimal and used an init-time DNS TXT command loop in v1.3.3.",
  "date": "2026-05-24",
  "severity": "high",
  "tags": [
    "supply-chain",
    "go",
    "typosquatting",
    "dns",
    "backdoor"
  ],
  "sources_count": 5,
  "indicators": {
    "slug": "shopsprint-decimal-go-typosquat",
    "since": "2023-08-19T09:27:21Z",
    "until": "2026-05-24T23:59:59Z",
    "ecosystem": "go modules proxy.golang.org and pkg.go.dev",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [],
    "packages": [
      "github.com/shopsprint/decimal"
    ],
    "versions": [
      "v1.3.3",
      "github.com/shopsprint/decimal v1.3.3"
    ],
    "affectedVersions": [],
    "fixedVersions": [],
    "files": [
      "go.mod",
      "go.sum",
      "decimal.go"
    ],
    "paths": [],
    "services": [],
    "domains": [
      "dnslog-cdn-images.freemyip.com",
      "freemyip.com"
    ],
    "urls": [],
    "ips": [],
    "hashes": [
      "f31bdd069fe7966ae11be1f78ee5dd44445938856dd1df12379e0e84a6851f5c"
    ],
    "processPatterns": [
      "Go application importing github.com/shopsprint/decimal"
    ],
    "networkPatterns": [
      "TXT query to dnslog-cdn-images.freemyip.com every five minutes"
    ],
    "telemetrySelectors": []
  }
}