Go module design blocks npm-style worm attacks but retains security exposure points

An August 4 npm worm spread through hundreds of packages by exploiting preinstall script execution and stolen publishing tokens. Go's module system prevents similar attacks by design since no code runs during dependency downloads and modules lack publishable registries. However, Go dependencies execute with full environment access during commands like go test, potentially exposing tokens and secrets. The worm succeeded on npm because poisoned packages carried valid provenance signatures from compromised release pipelines.