Graphalgo malware was distributed through two Terraform providers and two Go modules, using conditional activation to remain inert outside specially crafted runtime conditions. Its Go-based RAT collects host information and receives encrypted commands through Slack workspaces and an Ethereum smart contract on the Arbitrum Sepolia testnet. Shared infrastructure and cryptographic material connect the samples to earlier Graphalgo npm payloads, while fake Go ecosystem websites and forged Git commits were used to lend legitimacy to malicious packages. Aikido observed 18 unique hostnames in check-in data and assessed the operation as small and targeted.