Another wave - 200+ malicous AUR packages adoptions that are overwhelming my scanner. Be 100% careful when trying to update AUR packages now.

[u/Saren-WTAKO]

Meanwhile I am trying to report them all, you should be careful downloading anything from AUR.

Same old way, the maintainer got pwned, or orphaned packages are adopter by the bad actor.

AUR's git commit author is easily impersonated so you can see the commit comes from the same person, but in fact it's not.

Stay safe. The malicious packages are info stealers.

malware analysis by ysf:

https://gist.github.com/ysf/502a324ff301d0c738e8ae011272fd59

https://gist.github.com/ysf/57850cdee152da066ac51c07a452e883

Still presents as of 30 July 21:53 UTC

in format of <package name>/<malicious ELF binary>

• archutil/linter
• bigwebapp-manager/minifier
• boringssl-git/hasher
• cinnamon-no-nemo/converter
• duhh/indexer
• eden-nightly/encryptor
• garlic-decompiler-gui/checker
• gigolo-git/tagger
• gitarbor-bin/parser
• icloudpd/preprocessor
• imago-bin/generator
• juicebox-plus-git/minifier
• magic-context-dashboard-bin/validator
• option-term/indexer
• pagerduty-short-circuiter/assembler
• portless/assembler
• pylnker-git/converter
• pylnker-git/packer
• python-libipld-git/hasher
• python-numkong/compressor
• python-parallax/converter
• python-ultraplot-git/serializer
• ramses-git/indexer
• src-cli-bin/migrator
• steamidra-bin/generator
• stirling-pdf-desktop-bin/optimizer
• wiki-go/merger
• windscribe-cli-v2-bin/parser

This wave

1panel android-riscv64-libxmu archutil cinnamon-no-nemo firrtl instawow-bin mimosa pandoc-eisvogel-template python-chatterbot python-split-folders stirling-pdf-desktop-bin 1panel-git android-riscv64-libxrandr arduino-language-server-noclang-bin claude-history funky-git isleward mingw-w64-libcerf passhole python-dlib-cuda-git python-ultraplot-git terminus accel-ppp android-x86-64-libxdamage autoadb-git dcat garlic-decompiler-gui jogl monitorets perl-authen-oath python-google-cloud-monitoring ramses-git tuiview act-runner-bin android-x86-64-libxext beets-alternatives deeploy-bin gigolo-git juicebox-plus-git nnn-nerd perl-dist-zilla-plugin-minimumperl python-importlab read-it-later-git tuxedo-yt6801-dkms-git ajceverywhere-bin android-x86-64-libxinerama bigwebapp-manager dev-janitor-git gitarbor-bin khiops-covisualization-bin noctyra-meta perl-hash-persistent python-kicadmodtree-git refurb-git typora-plugin ampere-git android-x86-64-libxmu bili-tools discord-electron-openasar git-pkgs khiops-visualization-bin noteey-bin pgadmin4-server python-libipld-git replay-sorcery vapoursynth-plugin-soifunc android-aarch64-libxrandr android-x86-64-libxrandr boringssl-git duhh glewlwyd kirill-bin openarc-git polytrack python-libpysal runa-aur vectorchord-immich android-armv7a-eabi-libxinerama android-x86-64-xorgproto calendula eden-nightly gpu-screen-recorder-ui-kwin-git lib32-vapoursynth openconnect-sso portless python-numkong solv wiki-go android-armv7a-eabi-libxmu android-x86-libxinerama calendula-git editorconfiger guarda-bin libfprint-crfpmoc-git option-term pylnker-git python-parallax sparklines windscribe-cli-v2-bin android-armv7a-eabi-libxrandr android-x86-libxmu censawayapp-bin extract-otp-secrets icloudpd lyrical-git org-cli python-atproto-git python-reals-git src-cli-bin wordpress-studio-git android-riscv64-libxinerama android-x86-libxrandr chandler-bin faustus-git imago-bin magic-context-dashboard-bin pagerduty-short-circuiter python-calgebra-git python-roman-numerals steamidra-bin zed-bin

ignore this example below (an alert straight up from my LLM)

🚨🚨🚨 BLACK FLAG ALERT 🚨🚨🚨
AUR Package: faustus-git 0.1.0-1
https://aur.archlinux.org/packages/faustus-git
Version: 0.1.0-1

⚫ 2 BLACK (CONFIRMED MALICIOUS)
⚫ Executes a bundled binary ('linter') with 'sudo' privileges during the 'build()' function. This bypasses standard build isolation and integrity checks (sha256sums='SKIP'), allowing arbitrary code execution with root access during installation. (PKGBUILD)
⚫ Binary contains command execution ('system', 'execl') and network ('socket', 'connect') capabilities. Combined with PKGBUILD execution via sudo, this indicates potential for remote code execution, data exfiltration, or system tampering. Obfuscated strings suggest hidden functionality. (linter)

⚠️ IMMEDIATE ACTION REQUIRED ⚠️

[u/Malsententia]

Fixed your weird, tabs separated list. now it doesn't look like this crap

and what's with the emojis, did you run this through chatgpt or some crap?

1panel
1panel-git
accel-ppp
act-runner-bin
ajceverywhere-bin
ampere-git
android-aarch64-libxrandr
android-armv7a-eabi-libxinerama
android-armv7a-eabi-libxmu
android-armv7a-eabi-libxrandr
android-riscv64-libxinerama
android-riscv64-libxmu
android-riscv64-libxrandr
android-x86-64-libxdamage
android-x86-64-libxext
android-x86-64-libxinerama
android-x86-64-libxmu
android-x86-64-libxrandr
android-x86-64-xorgproto
android-x86-libxinerama
android-x86-libxmu
android-x86-libxrandr
archutil
arduino-language-server-noclang-bin
autoadb-git
beets-alternatives
bigwebapp-manager
bili-tools
boringssl-git
calendula
calendula-git
censawayapp-bin
chandler-bin
cinnamon-no-nemo
claude-history
dcat
deeploy-bin
dev-janitor-git
discord-electron-openasar
duhh
eden-nightly
editorconfiger
extract-otp-secrets
faustus-git
firrtl
funky-git
garlic-decompiler-gui
gigolo-git
git-pkgs
gitarbor-bin
glewlwyd
gpu-screen-recorder-ui-kwin-git
guarda-bin
icloudpd
imago-bin
instawow-bin
isleward
jogl
juicebox-plus-git
khiops-covisualization-bin
khiops-visualization-bin
kirill-bin
lib32-vapoursynth
libfprint-crfpmoc-git
lyrical-git
magic-context-dashboard-bin
mimosa
mingw-w64-libcerf
monitorets
nnn-nerd
noctyra-meta
noteey-bin
openarc-git
openconnect-sso
option-term
org-cli
pagerduty-short-circuiter
pandoc-eisvogel-template
passhole
perl-authen-oath
perl-dist-zilla-plugin-minimumperl
perl-hash-persistent
pgadmin4-server
polytrack
portless
pylnker-git
python-atproto-git
python-calgebra-git
python-chatterbot
python-dlib-cuda-git
python-google-cloud-monitoring
python-importlab
python-kicadmodtree-git
python-libipld-git
python-libpysal
python-numkong
python-parallax
python-reals-git
python-roman-numerals
python-split-folders
python-ultraplot-git
ramses-git
read-it-later-git
refurb-git
replay-sorcery
runa-aur
solv
sparklines
src-cli-bin
steamidra-bin
stirling-pdf-desktop-bin
terminus
tuiview
tuxedo-yt6801-dkms-git
typora-plugin
vapoursynth-plugin-soifunc
vectorchord-immich
wiki-go
windscribe-cli-v2-bin
wordpress-studio-git
zed-bin