{"id":180407,"date":"2025-07-31T21:07:21","date_gmt":"2025-07-31T21:07:21","guid":{"rendered":"https:\/\/linuxiac.com\/?p=180407"},"modified":"2025-07-31T23:54:39","modified_gmt":"2025-07-31T23:54:39","slug":"arch-aur-under-fire-once-more-as-malware-resurfaces","status":"publish","type":"post","link":"https:\/\/linuxiac.com\/arch-aur-under-fire-once-more-as-malware-resurfaces\/","title":{"rendered":"Arch AUR Under Fire Once More as Malware Resurfaces"},"content":{"rendered":"\n

The AUR (Arch User Repository)\u2014a community-driven collection of software contributed by Arch users\u2014has long been seen as one of Arch Linux\u2019s biggest strengths, often called its hidden gem. But over the past two weeks, it\u2019s been stirring up some serious concern among its massive user base.<\/p>\n\n\n\n

Just ten days ago, a few software packages in the AUR were found to contain a Remote Access Trojan<\/a> (RAT), hidden in packages tied to some of the most popular web browsers. Of course, the AUR team acted quickly and pulled them right away. But now, here we are again\u2014it’s happened all over.<\/p>\n\n\n\n

It’s pretty shocking that this time around, the situation is almost exactly the same\u2014a package called google-chrome-stable<\/strong><\/em> doesn’t just install Google\u2019s browser, but also runs a RAT<\/a> on your system. That kind of malware can potentially give attackers control over the infected machine, letting them steal data, install more malicious software, or spy on users.<\/p>\n\n\n\n

The package in question was uploaded earlier today by a user who had just registered a few hours ago under the nickname forsenontop<\/a>.<\/p>\n\n\n\n

\"The
The user account that uploaded the malicious software to AUR.<\/figcaption><\/figure>\n\n\n\n

So, what\u2019s actually going on? In the AUR\u2019s PKGBUILD for the google-chrome-stable<\/code> package, there\u2019s an install<\/code> directive that points to a file called google-chrome-bin.install<\/code>. That file, in turn, calls a launcher script named google-chrome-stable.sh<\/code>.<\/p>\n\n\n\n

But if you take a closer look, you\u2019ll quickly notice something suspicious\u2014before Chrome even starts, the script runs a python<\/code> command that pulls in an external resource. That resource then downloads and launches malicious software every single time<\/em> you start Chrome.<\/p>\n\n\n\n

Just for clarification, the -c<\/code> option tells Python to execute a command passed as a string directly from the command line.<\/p>\n\n\n\n

\"AUR
AUR package (google-chrome-stable), injected with malware.<\/figcaption><\/figure>\n\n\n\n

The good news\u2014if you can call it that\u2014is that the google-chrome-stable<\/code> package was available on the AUR only for a few hours before the malware hidden inside was discovered. Still, it did get a few upvotes, which suggests at least some users ended up installing it.<\/p>\n\n\n\n

Thankfully, once the report came in<\/a>, AUR admins acted immediately and pulled the package. So, if you installed it, make sure to remove it right away<\/em> and do a full security check on your system. But honestly, in a situation like this, doing a full OS preinstall is really the only guaranteed way to fix things and give you peace of mind.<\/p>\n\n\n\n

In the end, this latest incident brings up the same old question: just how safe is it to use software from AUR? One thing needs to be clear, though\u2014Arch developers aren\u2019t responsible for what\u2019s in the AUR. The software there is completely contributed to and maintained by the Arch community, and the Arch team does not officially support it.<\/p>\n\n\n\n

That said, it\u2019s probably a smart move to tighten the rules around how software gets uploaded there. This latest incident shows just how easy it is for a completely fake account\u2014created just a few hours earlier\u2014to upload something with a name like google-chrome-stable<\/code>. And let\u2019s be honest, a name like that looks totally legit to most people. Without taking a closer look at what\u2019s actually inside, a lot of users just go ahead and install it.<\/p>\n\n\n\n

Looking at the pattern, it\u2019s clear that browsers are the go-to target for spreading malicious software\u2014just like in the previous incident. And honestly, that\u2019s not surprising. Browsers are among the most popular and widely installed apps out there.<\/p>\n\n\n\n

So, next time you\u2019re about to install something from AUR<\/a>, take a second to check if the package has a solid track record. A package with some history behind it gives you at least a little peace of mind. But whatever you do, never<\/strong> install something that was just uploaded and has no background\u2014no matter how trustworthy the name might sound.<\/p>\n","protected":false},"excerpt":{"rendered":"

Just ten days after a previous incident, malware with a Remote Access Trojan has once again been discovered in Arch Linux AUR packages.<\/p>\n","protected":false},"author":10,"featured_media":180410,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,5],"tags":[4264,4487,3374],"class_list":["post-180407","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-os","category-news","tag-arch-linux","tag-aur","tag-security"],"blocksy_meta":[],"_links":{"self":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/posts\/180407","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/comments?post=180407"}],"version-history":[{"count":0,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/posts\/180407\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/media\/180410"}],"wp:attachment":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/media?parent=180407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/categories?post=180407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/tags?post=180407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}