Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor

A typosquatted Go module posing as the popular shopspring/decimal library lay dormant for years before being weaponized with a DNS-based backdoor that enables silent, on-demand command execution on any system importing the malicious package, exposing countless developer and production environments to covert compromise.