If you’re thinking about the recent thing, the real Go library (boltdb/bolt) was not compromised at all. The malware was in a similarly named package (boltdb-go/bolt), this is called “typosquatting”.

Link to article

I think different, the project is something like 7 months old