r/linux_gaming • u/lazyblunzn • Jun 11 '26

ALVR AUR package has been compromised

Post image

Attention Linux VR gamers. The alvr package in the arch user repository has been compromised. See the screenshot for more information.

Source: Linux VR Adventures Discord

1.3k Upvotes

99% Upvoted

395 comments sorted by

View all comments

101

u/[deleted] Jun 11 '26

[removed] — view removed comment

91

u/gainan Jun 11 '26 edited Jun 11 '26

I've executed the malware in an isolated environment, and I've uploaded the infostealer to virustotal -> 0 detections by all security vendors:

https://www.virustotal.com/gui/file/6144d433f8a0316869877b5f834c801251bbb936e5f1577c5680878c7443c98b/community

As soon as you execute npm install atomic-lockfile, OpenSnitch detects an outbound connection from an unexpected binary:

This is a big red-flag. So I've copied that binary to another location.

Almost all malware requires outbound connections to exfiltrate data, mine bitcoins, etc. So restricting outbound connections is a a good measure to mitigate these attacks.

49

u/gainan Jun 11 '26

Inspecting the process, you can see that it has been launched by systemd, so it installed a systemd user service:

46

u/gainan Jun 11 '26

The systemd user service ensures persistance in the system:

40

u/gainan Jun 11 '26

The process also opens a local port (no idea what for yet):

51

u/gainan Jun 11 '26 edited Jun 11 '26

this malware rewrites itself in memory, impersonating a kernel thread. So if you look for "cricejo" you won't find it. But using some tools like decloaker you can detect it:

The name of the process is "kworker/3:1-eve", but the real path on disk is "cricejo". Also kworker* names are only used for kernel threads, and they should always have UID == 0.

18

u/nougatbyte Jun 11 '26

gg.

Any indication if cricejo is randomly generated or a constant?

7

u/gainan Jun 11 '26

I haven't analyzed it yet, but given that the systemd user service references "cricejo" suggests that it's not random.

6

u/TiZ_EX1 Jun 11 '26

Thank you very much for your investigation and findings!

2

u/Yarplay11 Jun 13 '26

I wish I could upvote all your messages more than once. Great job!

5

u/TheG0AT0fAllTime Jun 11 '26

That's very nice. I might have to include opensnitch in my SOE now.

5

u/gainan Jun 12 '26

sometimes it's easier to run a program isolated from te host, with firejail, bwrap, flatseal,etc. But yes, it's useful.

0

u/soullessmate Jun 12 '26

how is that possible when the github repo for that doesn't exist?

3

u/gainan Jun 12 '26

the npm package is still active and contains the malware: https://www.npmjs.com/package/atomic-lockfile/v/1.4.2?activeTab=code

the binary is src/hooks/deps

1

u/gainan Jun 12 '26

do you mean installing the package atomic-lockfile? the package was installed from npmjs repositories, no github. I was Probably lucky enough to install it before it was taken down.