news
Malware Discovered in Arch Linux AUR Packages
Quoting: Malware Discovered in Arch Linux AUR Packages —
If you are an Arch user, you know – AUR (Arch User Repository) is a double-edged sword—it’s incredibly useful but requires caution. Unfortunately, that caution was warranted yet again this week when three AUR packages were found to contain malware.
The issue came to light on July 16 when a user uploaded a malicious package, librewolf-fix-bin, to the AUR. Within hours, two more packages—firefox-patch-bin and zen-browser-patched-bin—followed, all traced back to the same bad actor.
Security researchers quickly identified the threat: a Remote Access Trojan (RAT) hidden in a script pulled from a GitHub repository. For those unfamiliar, a RAT is no joke—it can grant attackers full control over an infected system, enabling them to steal data, install additional malware, or spy on users.
Update
More in LWN:
-
Malicious packages uploaded to the Arch GNU/Linux AUR
The Arch GNU/Linux project has sent out an advisory warning that a set of malicious packages, containing a remote access trojan, were uploaded to the Arch User Repository (AUR). The affected packages were librewolf-fix-bin, firefox-patch-bin, and zen-browser-patched-bin. "
We strongly encourage users that may have installed one of these packages to remove them from their system and to take the necessary measures in order to ensure they were not compromised.
"