On the 16th of July, at around 8pm UTC+2, a malicious AUR package was uploaded to the AUR. Two other malicious packages were uploaded by the same user a few hours later. These packages were installing a script coming from the same GitHub repository that was identified as a Remote Access Trojan (RAT).
The affected malicious packages are:
- librewolf-fix-bin
- firefox-patch-bin
- zen-browser-patched-bin
The Arch Linux team addressed the issue as soon as they became aware of the situation. As of today, 18th of July, at around 6pm UTC+2, the offending packages have been deleted from the AUR.
We strongly encourage users that may have installed one of these packages to remove them from their system and to take the necessary measures in order to ensure they were not compromised.
Follow up
There are more packages with this malware found.
minecraft-crackedttf-ms-fonts-allvesktop-bin-patchedttf-all-ms-fonts
What to do
If you installed any of these packages, check your running processes for one named systemd-initd (this is the RAT).
The suspicious packages have a patch from this now-inaccessible Codeberg repo: https://codeberg.org/arch_lover3/browser-patch
The Arch maintainers have been informed of all this already and are investigating.
Yeah, to be fair the AUR is known to be very susceptible to that kind of thing due to the effective absence of entry requirements.
Absolutely.
The Arch User Repository is a way for anyone to easily distribite software.
Hence it has never been secure, and rather than claim it is, you mostly see people and documentation warn you about this, and to be careful if using it.
Any schmuck can make whatever they want available via the AUR. That’s how even the tiniest niche project can often be installed via the AUR. But you trade in some security for that convenience.
It shouldn’t be used as a marketplace, it should be used as a repository. You can probably find a lot of malware on GitHub, doesn’t mean you go there to choose your text editor.
I never search the AUR directly, I only use it if some README tells me I can install their software via an AUR package.
Yeah, I search the AUR not to discover packages, but to see if something I want to install is in there, if it is I check the PKGBUILD and make sure none of the sources/commands/patches are suspicious.
People need to remember it’s not some carefully vetted app store and that they need to be the ones vetting any packages they install and any changes when updating.