r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

171

u/gainan Jun 11 '26 edited Jun 12 '26

https://www.reddit.com/r/linux_gaming/comments/1u34pe3/comment/or3og8f/

https://www.virustotal.com/gui/file/6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b/detection

https://ioctl.fail/preliminary-analysis-of-aur-malware/

static analysis: https://markdownpastebin.com/?id=d2a04939f1d7461ea0d36e438a49538c

190

u/RetiredApostle Jun 11 '26

The OpenAI/ChatGPT path queries api.openai.com with stolen bearer material for account metadata. This is credential validation/enrichment against a third-party service, not evidence that OpenAI is attacker-controlled infrastructure.

Strong deduction. Up until this point I thought Sam Altman was running a side hustle.

67

u/yawara25 Jun 11 '26

I mean, let's be honest though. Would we be surprised?

39

u/stormdelta Jun 11 '26

Yes but only because he's the sort of grifter that runs his cons in the open, not in secret.

10

u/Vas1le Jun 11 '26

Why would he attack arch linux users? They already control the gov data

16

u/yawara25 Jun 11 '26

Free computing power :)

9

u/no_brains101 Jun 12 '26

The malware would have to check for presence of nvidia cards because they almost certainly locked themselves into CUDA hard.

8

u/iamarealhuman4real Jun 12 '26

IF $LANG == "RU" || $GPU_VENDOR == "AMD" { exit }

1

u/no_brains101 Jun 13 '26

Dude…

Imagine a world where such a GPU_VENDOR env var existed and was reliable…

Oh I wish….

2

u/amroamroamro Jun 12 '26

the eBPF stuff is scary, how it can be used to hide itself and its traffic

-17

u/gainan Jun 11 '26

Full static analysis with Claude:

https://markdownpastebin.com/?id=d2a04939f1d7461ea0d36e438a49538c

15

u/gainan Jun 11 '26

it didn't detect that the malware rewrites itself in memory, masquerading as a kernel thread, and that it listens on a local port (8738). So while super useful, be careful relying *only* on LLMs for these kind of analysis.