To be fair the AUR is known to be very susceptible to that kind of thing due to the effective absence of entry requirements.

i don't use arch (btw).

The affected malicious packages are:

• librewolf-fix-bin
• firefox-patch-bin
• zen-browser-patched-bin

What a nice attack on privacy-friendly infrastructure.

And then, Arch AUR has such suspicious things like the Brave browser which claims to reduce tracking.... and works together with advertisers.

To be clear, AUR is fantastic if you develop some experimental package and you want to give it to your friends to try it out easily. But not as a general distribution mechanism.

We are getting to the point where inviting more people in means we will need an automated babysitter to watch for this shit and to pull it once it’s discovered. Apple has a walled garden approach that’s certainly taken a big chunk of malware threats out of their devices but their walled garden approach is ridiculous and impractical for Linux. The Microsoft method of monitoring and second guessing everything with antimalware programs is also suspect because it is super easy to abuse and resource intensive. We have clamAV but clam kinda sucks.

Linux is at the point where we need something that audits what’s going in and automatically yanks it back out remotely if it’s found to be a problem. Things can only be added by the user, but the bot can remove them without interaction of the user.

I don’t see this happening though. Instead, I see this as more of a rust vs C thing all over again, where valid critiques are drowned out by “improve your skills bro.”

To check your system for those packages (assuming you are using bash):

comm -1 -2 <(pacman -Q | awk '{print $1}' | sort) <(sort vulnerable_packages.txt)

With vulnerable_packages.txt containing one package name per line.

the firefox, zen browser and libre wolf packages are concerning. The ttf ms font too. Those are very normal apps and unless you pay attention to the package name when doing "pacman -Syu", you would fall for the malware.

If only we can compartmentalize all AUR packages. The download AUR sources iirc are already in something like $HOME/.paru. Installing is a different story, because these packages can put their executable all over the places: /usr/local/bin, $HOME/local/bin.

minecraft-cracked

Gotta assume that if any Arch users actually fell for that one, that they either let their kids use their device or they're generally not smart ( which absolutely goes against my stereotypical view of an arch user ).

Wait what happens once some government or state actor hacks rust's install script rustup with its curl | bash install procedure and relying on TLS certificates which are e.g. issued by the Russian government. (No, the rust project won't use a Russian/Chinese/US Gov certificate but your browser will trust near all of them...)

Why are they called "patched" and "fix" and who is installing them?

I already assumed aur was riddled with stuff like that.

Use a condom when fucking around in there.

The affected malicious packages are:

librewolf-fix-bin firefox-patch-bin zen-browser-patched-bin

So...did someone just like create a new package cloning these or did they somehow get into the "official" repository? Is there no attestation process?