By the time it’s in your go.mod, the malicious software has already been downloaded and installed on your machine, though. Damage may already have been done at that point.