Arch Linux und deren AUR mal wieder
Geschrieben am 02-08-2026 - ⧖ 1.0 minAnother wave - 200+ malicous AUR packages adoptions that are overwhelming my scanner. Be 100% careful when trying to update AUR packages now.
Meanwhile I am trying to report them all, you should be careful downloading anything from AUR.
Same old way, the maintainer got pwned, or orphaned packages are adopter by the bad actor.
AUR's git commit author is easily impersonated so you can see the commit comes from the same person, but in fact it's not.
Stay safe. The malicious packages are info stealers.
=============
malware analysis by ysf:
https://gist.github.com/ysf/502a324ff301d0c738e8ae011272fd59
https://gist.github.com/ysf/57850cdee152da066ac51c07a452e883
=============
Still presents as of 30 July 21:53 UTC
[...] https://www.reddit.com/r/archlinux/comments/1vaxtcs/another_wave_200_malicous_aur_packages_adoptions/
But wait.. there is more!
- https://www.reddit.com/r/archlinux/comments/1v9scc5/seemingly_malicious_aur_package_found_where_to/
- https://gist.github.com/ysf/502a324ff301d0c738e8ae011272fd59
- https://gist.github.com/ysf/57850cdee152da066ac51c07a452e883
- https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/WQPQFSOP5WHKFZRZYHI75RKT23N6DBLE/
- https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/DRDEU3JUSC72CB265XHXPFA3DFSLXPBP/
Aber das ist sind ja nur Einzelfälle!!1! Langsam kommen mir Arch-User so vor wie die Apple-Fanbois.. so sehr kann die Scheisse gar nicht stinken, das sie sie nicht fressen würden.