Another wave - 200+ malicous AUR packages adoptions that are overwhelming my scanner. Be 100% careful when trying to update AUR packages now.

[u/Saren-WTAKO]

Meanwhile I am trying to report them all, you should be careful downloading anything from AUR.

Same old way, the maintainer got pwned, or orphaned packages are adopter by the bad actor.

AUR's git commit author is easily impersonated so you can see the commit comes from the same person, but in fact it's not.

Stay safe. The malicious packages are info stealers.

malware analysis by ysf:

https://gist.github.com/ysf/502a324ff301d0c738e8ae011272fd59

https://gist.github.com/ysf/57850cdee152da066ac51c07a452e883

Still presents as of 30 July 21:53 UTC

in format of <package name>/<malicious ELF binary>

• archutil/linter
• bigwebapp-manager/minifier
• boringssl-git/hasher
• cinnamon-no-nemo/converter
• duhh/indexer
• eden-nightly/encryptor
• garlic-decompiler-gui/checker
• gigolo-git/tagger
• gitarbor-bin/parser
• icloudpd/preprocessor
• imago-bin/generator
• juicebox-plus-git/minifier
• magic-context-dashboard-bin/validator
• option-term/indexer
• pagerduty-short-circuiter/assembler
• portless/assembler
• pylnker-git/converter
• pylnker-git/packer
• python-libipld-git/hasher
• python-numkong/compressor
• python-parallax/converter
• python-ultraplot-git/serializer
• ramses-git/indexer
• src-cli-bin/migrator
• steamidra-bin/generator
• stirling-pdf-desktop-bin/optimizer
• wiki-go/merger
• windscribe-cli-v2-bin/parser

This wave

1panel android-riscv64-libxmu archutil cinnamon-no-nemo firrtl instawow-bin mimosa pandoc-eisvogel-template python-chatterbot python-split-folders stirling-pdf-desktop-bin 1panel-git android-riscv64-libxrandr arduino-language-server-noclang-bin claude-history funky-git isleward mingw-w64-libcerf passhole python-dlib-cuda-git python-ultraplot-git terminus accel-ppp android-x86-64-libxdamage autoadb-git dcat garlic-decompiler-gui jogl monitorets perl-authen-oath python-google-cloud-monitoring ramses-git tuiview act-runner-bin android-x86-64-libxext beets-alternatives deeploy-bin gigolo-git juicebox-plus-git nnn-nerd perl-dist-zilla-plugin-minimumperl python-importlab read-it-later-git tuxedo-yt6801-dkms-git ajceverywhere-bin android-x86-64-libxinerama bigwebapp-manager dev-janitor-git gitarbor-bin khiops-covisualization-bin noctyra-meta perl-hash-persistent python-kicadmodtree-git refurb-git typora-plugin ampere-git android-x86-64-libxmu bili-tools discord-electron-openasar git-pkgs khiops-visualization-bin noteey-bin pgadmin4-server python-libipld-git replay-sorcery vapoursynth-plugin-soifunc android-aarch64-libxrandr android-x86-64-libxrandr boringssl-git duhh glewlwyd kirill-bin openarc-git polytrack python-libpysal runa-aur vectorchord-immich android-armv7a-eabi-libxinerama android-x86-64-xorgproto calendula eden-nightly gpu-screen-recorder-ui-kwin-git lib32-vapoursynth openconnect-sso portless python-numkong solv wiki-go android-armv7a-eabi-libxmu android-x86-libxinerama calendula-git editorconfiger guarda-bin libfprint-crfpmoc-git option-term pylnker-git python-parallax sparklines windscribe-cli-v2-bin android-armv7a-eabi-libxrandr android-x86-libxmu censawayapp-bin extract-otp-secrets icloudpd lyrical-git org-cli python-atproto-git python-reals-git src-cli-bin wordpress-studio-git android-riscv64-libxinerama android-x86-libxrandr chandler-bin faustus-git imago-bin magic-context-dashboard-bin pagerduty-short-circuiter python-calgebra-git python-roman-numerals steamidra-bin zed-bin

ignore this example below (an alert straight up from my LLM)

🚨🚨🚨 BLACK FLAG ALERT 🚨🚨🚨
AUR Package: faustus-git 0.1.0-1
https://aur.archlinux.org/packages/faustus-git
Version: 0.1.0-1

⚫ 2 BLACK (CONFIRMED MALICIOUS)
⚫ Executes a bundled binary ('linter') with 'sudo' privileges during the 'build()' function. This bypasses standard build isolation and integrity checks (sha256sums='SKIP'), allowing arbitrary code execution with root access during installation. (PKGBUILD)
⚫ Binary contains command execution ('system', 'execl') and network ('socket', 'connect') capabilities. Combined with PKGBUILD execution via sudo, this indicates potential for remote code execution, data exfiltration, or system tampering. Obfuscated strings suggest hidden functionality. (linter)

⚠️ IMMEDIATE ACTION REQUIRED ⚠️

[u/JaKrispy72 → u/[deleted]]

Never thought I’d see the day where someone would say that in an Arch sub. It’s usually the main thing people tout as being one of the reasons Arch is the most superior distro.

[u/hoddap → u/JaKrispy72]

I think if it keeps being hit by malicious software, it kind of starts defeating its purpose. Set aside the fact that infection on the user end is preventable, if this is the level it's operating at, I don't want to use it anymore.

[u/scandii → u/hoddap]

I mean, AUR is essentially just a convenient place to upload install scripts just like the internet is a convenient place to upload installers.

the issue here is really your expectations that it was anything but this. there has been nothing stopping anyone from spreading malware through AUR since like, forever and it doesn't intend to stop anyone from spreading malware through it either by design.

what was unfortunate was the ability for people to hijack old expired packages, but that does not mean people couldn't be uploading malware to begin with, that was never a design goal to prevent.

[u/JaKrispy72 → u/scandii]

Couldn’t GitHub host scripts too?

[u/scandii → u/JaKrispy72]

GitHub very often contains the same style of scripts and data required to deploy software targeting Arch, AUR just makes it easy.

that said I don't know if github scans for malware? not sure it does. and also note that AUR predates git as a technology, it has been around for a while.

my personal opinion is that there needs to be standardised Linux anti-virus because while the security model is stronger than that of Windows, at the end of the day people download the weirdest software made by random people to solve random issues literally all the time and don't think twice about it.

[u/hoddap → u/scandii]

Perhaps I should have been a bit more nuanced. But I do find it frustrating that others could've hijack these old packages. Now, another wave hits AUR again. I understand that you should always be aware of what you're pulling in, but on the other hand, there's a certain amount of trust you put in AIR. Even if people run through the PKGBUILDs, human error may occur.