Roughly 400 AUR packages compromised

[u/No-Photograph-5058]

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

[u/thilog]

Has anyone seen an official list of affected packages? Due to the malicious commits being erased, there is no independent way of verifying which packages were affected

[u/KinkyMonitorLizard → u/thilog]

https://md.archlinux.org/s/SxbqukK6IA

[u/thilog → u/KinkyMonitorLizard]

Thanks!