We identified the malicious cached package and petitioned for its removal from the Go Module Mirror on January 30, 2025 and then again on February 3, 2025.