46
Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit (thehackernews.com)
submitted 1 month ago by lemmydev2@infosec.pub to c/pulse_of_truth@infosec.pub
3 comments fedilink hide all child comments

Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them.

The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself. The AUR is Arch Linux's community package collection, and it is separate

you are viewing a single comment's thread
view the rest of the comments
[-] IAmYouButYouDontKnowYet@reddthat.com 8 points 1 month ago

What does this mean for the average dumbass like me?

[-] droppedtacos@lemmy.world 10 points 1 month ago* (last edited 1 month ago)

Also, if you're running an arch based system and you're worried, in the terminal you can run:

pacman -Qm

to display what're considered foreign packages that your system has installed and cross reference them, if any, with the list found here:

aur_check

[-] Sammirr@aussie.zone 9 points 1 month ago

It means that if you've installed (built) anything from the AUR in the last ~48 hours, and you were unlucky enough to choose an impacted package, then consider you machine compromised. The article does a better job of explaining.

this post was submitted on 12 Jun 2026
46 points (100.0% liked)

Pulse of Truth

2471 readers
29 users here now

Cyber Security news and links to cyber security stories that could make you go hmmm. The content is exactly as it is consumed through RSS feeds and wont be edited (except for the occasional encoding errors).

This community is automagically fed by an instance of Dittybopper.

Commenting rules:

founded 2 years ago
MODERATORS
krogoth@infosec.pub