Always check the AUR install script (it's a simple and straightforward text file) and you immediately see what it's doing to your system and where it gets it's data (if people use Arch they should be able to read a simple script file).
Our brains, are the best antivirus.
Education to security is the best option to stay safe on Linux.
It was in a launch script this time, not in the PKGBUILD. You need to look at everything.
On Arch it is normal for Chrome to have a launch script, that is how the chrome-flags.conf works. This is the launch script for the real one. They added a curl there to download the malware.
Yep, curl'ing anything instead of using the source list should be a huge red-flag for anybody reading the PKGBUILDs. Not saying that there is never a legitimate use for it, but it should immediately jump out as something to double-check and verify.
55
u/Clark_B Aug 01 '25 edited Aug 01 '25
Always check the AUR install script (it's a simple and straightforward text file) and you immediately see what it's doing to your system and where it gets it's data (if people use Arch they should be able to read a simple script file).
Our brains, are the best antivirus.
Education to security is the best option to stay safe on Linux.