Malicious Go modules gocommunity.io/orderedbtree and gogets.dev/btreex impersonate B-tree data structure libraries. The code collects host information such as hardware attributes, OS and hostname, and on matching trigger conditions decrypts and runs embedded Go code in a detached process, receiving tasking through third-party chat and blockchain services.