8 ms·

Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

146 points by rrampage 1y ago

jabjq 1y ago
> We strongly encourage users that may have installed one of these packages […] to take the necessary measures in order to ensure they were not compromised. How are they supposed to do that when you give them no information as to what the malware does?
- rwmj 1y ago
  Did you install one of those packages? If yes, nuke from orbit. More interesting questions are: - Who was the uploader? A packager? For how long? - Do they maintain other packages? - What steps can be taken to ensure that a similar problem doesn't happen in future?
  - gpm 1y ago
    Per the Wayback Machine the username used was danikpapas. As far as Google and duckduckgo know these are the only packages theat username ever uploaded. Considering the purpose was crime it's likely that that username was "stolen" and the person using it on other sites wasn't the same as the one doing this... The AUR is arch's repository of untrusted user maintained read-the-source-before-installing packages. There's really not much that can be done to prevent similar issues in the future... because the whole purpose of the AUR is to allow random people to upload packages. Arch doesn't ship with any way to install AUR packages other than downloading the tarball and building them locally. Tools for installing the packages usually force you to read the PKGBUILD that controls the build process (including getting sources) before letting you build the packages. I.e. the reasonable steps have already been taken. Edit: firefox-patch-bin was first submitted to the AUR 2025-07-16 21:33 (UTC), so less than two days before removal.
    - amy214 1y ago
      >Per the Wayback Machine the username used was danikpapas. As far as Google and duckduckgo know these are the only packages theat username ever uploaded. I mean... ... if this was a malicious actor who is to say they don't have 15 aliases on 5 linux distros
  - diggan 1y ago
    They are/were AUR packages it seems, anyone can spend 2 minutes and upload essentially anything there, like npm and similar. It's not necessarily a "maintainer" per se, as like the people who manage the packages in the proper Arch repositories, but entirely separate. With that comes the same warning as downloading random stuff from the internet and executing it, you need to carefully review everything before running/installing it, as you're basically doing a fancy version of "curl | bash" when using the AUR.
- gpm 1y ago
  It says what the malware does, it's a remote access toolkit... It gives control of your machine to the malware operator. The malware operator could have done anything with that access... There's no way for the maintainers to know what was done on any given infected machine.
  - sp0rk 1y ago
    Announcements like this typically contain information that will help users identify if they were compromised, such as the name of files that are dropped or modified when the malware is initialized, startup entry names, etc. Obviously the person with remote access can get in and manually start doing things on individual machines, but that doesn't mean there aren't indicators present from the programmatic actions the malware took before that point or on machines that weren't manually accessed.
    - akazantsev 1y ago
      Expecting a complete malware analysis from maintainers is a tad too much. Their goal is to notify users as soon as possible, even if no other information about the malware is available. Also, an attacker may leave no traces by simply dumping the payload to /tmp.
    - gpm 1y ago
      In addition to the point about "not being expected to do a full malware analysis"... Assuming the malware doesn't clean up after itself, `pacman -Q firefox-patch-bin librewolf-fix-bin zen-browser-patched-bin` would tell you if they are installed... but if it did clean up after itself... how are the maintainers supposed to know what steps were taken to clean up given that it's a rat that could be running different steps on different computers...
  - Shellban 1y ago
    This is really scary for those who manage multiple things. I'm considering running a factory reset on everything from my router to my Steam Deck and remote server.
- Ancapistani 1y ago
  It's ArchLinux. The user is expected to do their own due diligence.
  - johnisgood 1y ago
    And these packages are from AUR, they are not officially supported. AUR means Arch User Repository. You cannot even use Arch Linux's official package manager to install AUR packages either, you need an AUR helper ("makepkg" is sufficient though but it has limitations). These AUR helpers are not even official packages either. Not even yay: https://archlinux.org/packages/?sort=&q=yay https://archlinux.org/packages/?sort=&q=yay.
    - Ancapistani 1y ago
      I’m well aware. Arch isn’t my daily driver anymore, but I used it for many years before really committing to containerization. My desktop OS is much less of a concern now, so I mostly use macOS. It provides a decent shell and otherwise stays out of my way. I use Windows for gaming.
- npteljes 1y ago
  In case of any infection, the necessary measures are to take the affected machines offline, extract whatever data you need, and then wipe.
- michaelmrose 1y ago
  It's a remote access trojan. There is no acceptable way to be sure of removal short of full reinstalling every OS installed and reinstalling or rebuilding stuff in the Home dir from known good sources.
heavyset_go 1y ago
Anyone have a copy of it that I can poke at in a virtual machine?
- techjamie 1y ago
  You might be able to poke at the PKGBUILD on the wayback machine and see if the original sources work.
  - mzajc 1y ago
    The PKGBUILDs are not archived, but the package page does helpfully list its sources, one of which is https://github.com/danikpapas/zenbrowser-patch.git https://github.com/danikpapas/zenbrowser-patch.git (same for all three packages). I would assume that's where the malware is, but I couldn't find an archive. Does https://www.gharchive.org/ https://www.gharchive.org/ keep this sort of data? ETA: According to a Reddit post linked elsewhere in this thread, the payload was a binary file downloaded by a python script in the repository. It has been uploaded to VirusTotal, but downloading requires a premium subscription according to their docs: https://www.virustotal.com/gui/file/d9f0df8da6d66aaae024bdca26a228481049595279595e96d5ec615392430d67 https://www.virustotal.com/gui/file/d9f0df8da6d66aaae024bdca...
lorenzohess 1y ago
Could there be programmatic ways to help users characterize the safety of the AUR packages they install? Perhaps a program that prints all URLs in the PKGBUILD and offers the option for the user to open them in the browser? Or which automatically shows a diff if a PKGBUILD is updated? Highlighting changes would make it easier for the user to determine if he should spend time exploring those changes for malware. One could go even further and list all new commits, making it super easy for the user to check them. Maybe even integrate an LLM to help? Maybe commits from non long-time contributors could be flagged? There has to be a way to help users programmatically review updates to their AUR packages. Even if most of them won't spend the time.
- IceDragon200 1y ago
  As one commentor pointed out, in Arch it's the user's responsibility to review any AUR packages BEFORE installing them (and I say this as an Arch user and AUR package maintainer). This particular issue is with a binary (i.e. pre-built) package, normally in Arch it's expected from an AUR package that you will build it yourself and most if not all packagers prompt you to review and or edit the PKGBUILD before it does anything. Basically you could spot something suspicious in a source package, not so much in a binary package.
- WD-42 1y ago
  This is exactly what many of the AUR helpers like yay and paru already do - ask you to review the pkgbuild diffs before installing or updating.
- porridgeraisin 1y ago
  I like that idea of printing the URLs it downloads. Will help screen quickly if it's doing something malicious.
- Tharre 1y ago
  PKGBUILDs are just bash scripts following a certain function and variable naming convention. Even if you could somehow parse it safely and extract the URLs of the 'source' array, any attacker can just simply put an obfuscated version of the malware URL into the build() function and download it there. AUR clients already show you the diff if you update a package, but note that this were completely new packages anyway, uploaded 2 days ago, so that doesn't really apply here. LLMs are useless for reviewing if something is malicious, their false-positive rates would be way to high. And even ignoring that you'd have to hide the LLMs code from the attacker or he can just check if his package is detected as malicious and modify it until it isn't. Not something open source projects are keen on doing.
WD-42 1y ago
As Arch seemingly explodes in popularity I’m afraid we’ll start seeing more of this.
- yuvadam 1y ago
  Is arch exploding in popularity? Because of Omarchy or something else?
  - Phelinofist 1y ago
    I think I saw posts on Reddit with XQC saying Arch is the best. I mean it is. And I use Arch btw.
    - kwk1 1y ago
      An evaluation of what's best really depends on how one weighs different tradeoffs. For example, Debian and Arch are basically polar opposites in terms of two questions: 1) do you want an intermediary between you and the upstream? for example, to patch out telemetry 2) is it important that what you're using continues to work the same way so you can focus on your actual work? No answer to either is consequence-free, e.g. for 1), see the Debian SSH patch event, or for 2), if the answer is "it doesn't work", then that kinda forces one's hand.
      - gpm 1y ago
        There's also the significant caveat with 2 that it's only "continues to work the same way" until everything changes all at once because you now need to update to the next version of Debian. The "everything changing all at once" thing is what eventually drove me to arch (as the most popular at the time rolling release distro - and more stable at the time than debian sid), I'd personally rather have smaller breaking changes more frequently. Though it's probably less painful now to update debian versions than it use to be because things generally work better without configuration than they used to.
  - deleted 1y ago
    [deleted]
mzajc 1y ago
Any clue what these packages were 'supposed' to do or why somebody might have installed them? Their PKGBUILD descriptions are copies of the respective browsers', not explaining the -patched part.
- Jorchime 1y ago
  I wondered about the same thing. Not an answer, but my guess would be that it's just a new package and they hoped someone picked it up by accident? In that case, it was patched with malware :)
  - Hackbraten 1y ago
    They (or someone in cahoots with them) made at least one attempt [0] to lure readers of the Arch Linux subreddit to the malicious PKGBUILD. IIRC, the post was just a single paragraph, praising how they “found” the zen-browser-patched-bin package on the AUR and how much it helped them. [0]: https://www.reddit.com/r/archlinux/comments/1m30py8/aur_is_so_awesome/ https://www.reddit.com/r/archlinux/comments/1m30py8/aur_is_s...
- Vortigaunt 1y ago
  Looks like someone archived the page of firefox-patch-bin[1] and the only thing that stands out about the package itself is that it's supposedly the "Extended Support Release." Besides that it looks like it's depended on by 183 other packages/metapackages. While that seems more interesting, there isn't an archive of all of those packages. [1]https://web.archive.org/web/20250718140411/https://aur.archlinux.org/packages/firefox-patch-bin https://web.archive.org/web/20250718140411/https://aur.archl...
  - deleted 1y ago
    [deleted]
  - mzajc 1y ago
    I saw the ESR part - I assumed the author (mistakenly?) copied firefox-esr's description. As for the dependents, it seems the malware package provided `firefox`, meaning all dependencies on `firefox` can instead be fulfilled by `firefox-patch-bin`. Perhaps the idea was to fool package managers into showing it as one of the alternatives.
jchoksi 1y ago
AUR packages are user-produced content i.e. packages built on their own machines. They have to be installed via "pacman -U package_file" Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package. VirusTotal's API is free. - https://docs.virustotal.com/docs/api-scripts-and-client-libraries https://docs.virustotal.com/docs/api-scripts-and-client-libr... - https://docs.virustotal.com/docs/please-give-me-an-api-key https://docs.virustotal.com/docs/please-give-me-an-api-key - https://docs.virustotal.com/docs/consumption-quotas-handled https://docs.virustotal.com/docs/consumption-quotas-handled Since it is end users who are doing the upload and virus scan check, there won't be a consumption quota issue with VirusToal. Lastly, "pacman -U" should flag failed VirusTotal scans to Arch Security. Arch's pacman and Flathub's flatpak package managers should be the last line of defence when installing untrusted packages by end users.
- akerl_ 1y ago
  Is this accurate? My understanding is that the AUR does not host binary packages. It hosts pkgbuild files, which contain config and scripts that a user has to build on their own machine in order to install. The malicious code here is fetched as part of those scripts.
  - johnisgood 1y ago
    No, it is NOT accurate. Pacman cannot be used to download, compile, or install AUR packages. You need the PKGBUILD file and use "makepkg -si" at the very least. If you want AUR packages, you'd install a package manager (in this context referred to as AUR helper) like "yay" that supports both official and unofficial (i.e. AUR) packages. FWIW AUR helpers are not even official packages, not even "yay" which is a popular one. You need to go out of your way to install "yay" (although it is one command away before, i.e. very easy). TL;DR: Pacman does not download, compile, or install packages from the AUR, nor does it resolve their dependencies. "makepkg -si" builds and installs a package based on the PKGBUILD file, or use an AUR helper that overcomes the limitations of "makepkg". AUR helpers make it easy to install AUR (i.e. unofficial) packages.
    - 1y ago
defraudbah 1y ago
i installed a lot of cra* from aur in the past, wouldn't be surprised if i got a malware somewhere. Strange thing, I don't think open snitch would even help in such situation.. and official repo does not have enough packages to run arch :\ I don't want to go back to ubuntu
- gus_ 1y ago
  I haven't taken a look at the malware, but it seems to download files from the Internet so it should have warned you to allow/deny the outbound connections. It'd be nice to test it with a sample of aur package/malware.
  - defraudbah 1y ago
    it does, I am using it extensively (little snitch on mac, and open snitch on linux). My problem with it is that every new tool wants to connect to the internet and my terminal is the constant source of outbound connections. I try to review everything but the amount of tools and connections is overwhelming. It does limit the risk, but i do not trust my terminal and dev tools as usually i give them way too many permissions and any plugin or tool from AUR can contain malware PS. Regarding downloading files from internet, every self-update tool does that nowadays, it becomes more common because of apple/others stores policies. I created a few remote control tools and it is very very difficult to caught them, and I am not even a professional malware researcher. Things they do is beyond understanding of average superuser
Barrin92 1y ago
There's always been this security theater of people recommending arch because they "don't trust the companies" or Canonical or what have you but frankly I'm surprised this hasn't happened sooner. Well or maybe it has and we don't know. Running random binaries on your computer uploaded by some anonymous dude has to be the equivalent of buying heart medicine on craigslist. And because Arch is so barebones to begin with the AUR is very popular, you see a lot of arch users using it.
- h4ck_th3_pl4n3t 1y ago
  Arch bugfix time is usually within 24 hours. Not a single enterprise distro even reacts within that timeframe. OVAL advisories are weeks, sometimes months later. As long as you don't have a virtualization approach similar to QubesOS, any linux distro will not fix this problem. Because that's not how separation of concerns works in the POSIX system. You need to have separate users for each and every program to isolate them, and that is practically unfeasible.
- WD-42 1y ago
  How exactly is Arch barebones? It basically ships with everything I need, more than most distros (Zed and Discord are good examples). I don't even need to use the AUR.
  - Barrin92 1y ago
    Just by taking a glance at the most popular packages (https://aur.archlinux.org/packages https://aur.archlinux.org/packages) Pretty much every browser that isn't Firefox including Chrome, VS Code, most proprietary software like Slack, Zoom, Spotify, many vpn clients and password managers, a lot of them seemingly not published by the companies in question. All of those ancillary password, vpn or security related products who aren't going to be in the main repo because they have proprietary elements and also rely on random people seems particularly bad. And there's a lot of software in that category.
    - WD-42 1y ago
      And what distro does package those? That's what Flatpak is for. If you must install crappy proprietary software, at least get an official package from the developer.
christophilus 1y ago
Man. I am on Fedora, but I do have a handful of copr packages installed. (Copr is the Fedora analogue of the AUR.) This makes me nervous. I guess it’s time to do some audits.
lilly-lizard 1y ago
it should be noted that these are different from the popular librewolf-bin (513 votes) and zen-browser-bin (176). with this in mind it's cool that these got identified only 2 days after being uploaded. I wonder if the reporter actually intended to install it or just reads the PKGBUILDS of new packages to be a good samaritan...
- Shellban 1y ago
  I only just noticed the difference myself. That was a scare!
npteljes 1y ago
I wonder how popular these packages were. Librewolf and Firefox sure are popular, so this sounds scary, but for example searching for "firefox-patch-bin aur" yields no results, aside from sites talking about how it contained malware. My impression is that the malice was spotted timely, and not many people were affected. Which is a pretty good thing!
akerl_ 1y ago
It seems odd that this is just on the AUR mailing list, and it the homepage, the announce list, or the security list.
- homebrewer 1y ago
  Why would it be? AUR is user generated content by definition, you're expected to read and understand every package before using it, which is repeated in documentation ad nauseam. They're very, very explicit about this and that you're on your own when using AUR. All decent AUR helpers (which arch developers advise against using anyway) force you to read through the packaging script and confirm that you understand it and are fine with what's about to be executed. It's no more of an issue than someone posting a malware script into e.g. the wiki. Much less obscure than malware in npm or anything like that.
  - akerl_ 1y ago
    This feels like a non-sequitur. Yes, the AUR is user-provided content. Yes, system administrators are responsible for being aware of what they’re installing. You can find many comments from me on this page discussing that. An attacker being detected using an official service hosted by Archlinux for user-managed packages to push malware is still noteworthy.
    - homebrewer 1y ago
      I guess we have very different takes on this; I wouldn't expect Slack or WhatsApp to publish security advisories if one of their users used them to spread malware among a tiny cohort of other users, which is about the right level of responsibility Arch places on itself (and it's very clear about this) w.r.t AUR.
      - akerl_ 1y ago
        I think you’re correct. I see a fundamental difference between services like slack and WhatsApp which provide messaging services and hosted platforms like the AUR where content is submitted and then republished on a site administered by the project.
RandyOrion 1y ago
Comments below is from the perspective of an arch Linux user, not maintainer or authors of some software. When installing softwares on arch Linux, first searching for official packages provided by Arch Linux maintainers, then official installation methods approved by authors of the software, or AURs which do the installation in the exact way as the authors of the software describe. A search on the default installation method of Firefox and librewolf package on arch Linux is listed below. If AUR is required to install a package, note that AURs are not trusted by default because not all AURs are not maintained by trusted users. Always check the source file and the installation method documented in PKGBUILD. Don't do the installation until EVERY line in the PKGBUILD is reasonable. https://wiki.archlinux.org/title/Firefox https://wiki.archlinux.org/title/Firefox https://librewolf.net/installation/arch/ https://librewolf.net/installation/arch/
- michaelmrose 1y ago
  This shouldn't reasonably be considered secure because it isn't altogether hard to obscure the nature of the attack until someone notices they are compromised.

146 points by rrampage 1y ago

> We strongly encourage users that may have installed one of these packages […] to take the necessary measures in order to ensure they were not compromised. How are they supposed to do that when you give them no information as to what the malware does?

rwmj 1y ago
Did you install one of those packages? If yes, nuke from orbit. More interesting questions are: - Who was the uploader? A packager? For how long? - Do they maintain other packages? - What steps can be taken to ensure that a similar problem doesn't happen in future?
- gpm 1y ago
  Per the Wayback Machine the username used was danikpapas. As far as Google and duckduckgo know these are the only packages theat username ever uploaded. Considering the purpose was crime it's likely that that username was "stolen" and the person using it on other sites wasn't the same as the one doing this... The AUR is arch's repository of untrusted user maintained read-the-source-before-installing packages. There's really not much that can be done to prevent similar issues in the future... because the whole purpose of the AUR is to allow random people to upload packages. Arch doesn't ship with any way to install AUR packages other than downloading the tarball and building them locally. Tools for installing the packages usually force you to read the PKGBUILD that controls the build process (including getting sources) before letting you build the packages. I.e. the reasonable steps have already been taken. Edit: firefox-patch-bin was first submitted to the AUR 2025-07-16 21:33 (UTC), so less than two days before removal.
  - amy214 1y ago
    >Per the Wayback Machine the username used was danikpapas. As far as Google and duckduckgo know these are the only packages theat username ever uploaded. I mean... ... if this was a malicious actor who is to say they don't have 15 aliases on 5 linux distros
- diggan 1y ago
  They are/were AUR packages it seems, anyone can spend 2 minutes and upload essentially anything there, like npm and similar. It's not necessarily a "maintainer" per se, as like the people who manage the packages in the proper Arch repositories, but entirely separate. With that comes the same warning as downloading random stuff from the internet and executing it, you need to carefully review everything before running/installing it, as you're basically doing a fancy version of "curl | bash" when using the AUR.
gpm 1y ago
It says what the malware does, it's a remote access toolkit... It gives control of your machine to the malware operator. The malware operator could have done anything with that access... There's no way for the maintainers to know what was done on any given infected machine.
- sp0rk 1y ago
  Announcements like this typically contain information that will help users identify if they were compromised, such as the name of files that are dropped or modified when the malware is initialized, startup entry names, etc. Obviously the person with remote access can get in and manually start doing things on individual machines, but that doesn't mean there aren't indicators present from the programmatic actions the malware took before that point or on machines that weren't manually accessed.
  - akazantsev 1y ago
    Expecting a complete malware analysis from maintainers is a tad too much. Their goal is to notify users as soon as possible, even if no other information about the malware is available. Also, an attacker may leave no traces by simply dumping the payload to /tmp.
  - gpm 1y ago
    In addition to the point about "not being expected to do a full malware analysis"... Assuming the malware doesn't clean up after itself, `pacman -Q firefox-patch-bin librewolf-fix-bin zen-browser-patched-bin` would tell you if they are installed... but if it did clean up after itself... how are the maintainers supposed to know what steps were taken to clean up given that it's a rat that could be running different steps on different computers...
- Shellban 1y ago
  This is really scary for those who manage multiple things. I'm considering running a factory reset on everything from my router to my Steam Deck and remote server.
Ancapistani 1y ago
It's ArchLinux. The user is expected to do their own due diligence.
- johnisgood 1y ago
  And these packages are from AUR, they are not officially supported. AUR means Arch User Repository. You cannot even use Arch Linux's official package manager to install AUR packages either, you need an AUR helper ("makepkg" is sufficient though but it has limitations). These AUR helpers are not even official packages either. Not even yay: https://archlinux.org/packages/?sort=&q=yay https://archlinux.org/packages/?sort=&q=yay.
  - Ancapistani 1y ago
    I’m well aware. Arch isn’t my daily driver anymore, but I used it for many years before really committing to containerization. My desktop OS is much less of a concern now, so I mostly use macOS. It provides a decent shell and otherwise stays out of my way. I use Windows for gaming.
npteljes 1y ago
In case of any infection, the necessary measures are to take the affected machines offline, extract whatever data you need, and then wipe.
michaelmrose 1y ago
It's a remote access trojan. There is no acceptable way to be sure of removal short of full reinstalling every OS installed and reinstalling or rebuilding stuff in the Home dir from known good sources.

heavyset_go 1y ago

Anyone have a copy of it that I can poke at in a virtual machine?

techjamie 1y ago
You might be able to poke at the PKGBUILD on the wayback machine and see if the original sources work.
- mzajc 1y ago
  The PKGBUILDs are not archived, but the package page does helpfully list its sources, one of which is https://github.com/danikpapas/zenbrowser-patch.git https://github.com/danikpapas/zenbrowser-patch.git (same for all three packages). I would assume that's where the malware is, but I couldn't find an archive. Does https://www.gharchive.org/ https://www.gharchive.org/ keep this sort of data? ETA: According to a Reddit post linked elsewhere in this thread, the payload was a binary file downloaded by a python script in the repository. It has been uploaded to VirusTotal, but downloading requires a premium subscription according to their docs: https://www.virustotal.com/gui/file/d9f0df8da6d66aaae024bdca26a228481049595279595e96d5ec615392430d67 https://www.virustotal.com/gui/file/d9f0df8da6d66aaae024bdca...

lorenzohess 1y ago

Could there be programmatic ways to help users characterize the safety of the AUR packages they install? Perhaps a program that prints all URLs in the PKGBUILD and offers the option for the user to open them in the browser? Or which automatically shows a diff if a PKGBUILD is updated? Highlighting changes would make it easier for the user to determine if he should spend time exploring those changes for malware. One could go even further and list all new commits, making it super easy for the user to check them. Maybe even integrate an LLM to help? Maybe commits from non long-time contributors could be flagged? There has to be a way to help users programmatically review updates to their AUR packages. Even if most of them won't spend the time.

IceDragon200 1y ago
As one commentor pointed out, in Arch it's the user's responsibility to review any AUR packages BEFORE installing them (and I say this as an Arch user and AUR package maintainer). This particular issue is with a binary (i.e. pre-built) package, normally in Arch it's expected from an AUR package that you will build it yourself and most if not all packagers prompt you to review and or edit the PKGBUILD before it does anything. Basically you could spot something suspicious in a source package, not so much in a binary package.
WD-42 1y ago
This is exactly what many of the AUR helpers like yay and paru already do - ask you to review the pkgbuild diffs before installing or updating.
porridgeraisin 1y ago
I like that idea of printing the URLs it downloads. Will help screen quickly if it's doing something malicious.
Tharre 1y ago
PKGBUILDs are just bash scripts following a certain function and variable naming convention. Even if you could somehow parse it safely and extract the URLs of the 'source' array, any attacker can just simply put an obfuscated version of the malware URL into the build() function and download it there. AUR clients already show you the diff if you update a package, but note that this were completely new packages anyway, uploaded 2 days ago, so that doesn't really apply here. LLMs are useless for reviewing if something is malicious, their false-positive rates would be way to high. And even ignoring that you'd have to hide the LLMs code from the attacker or he can just check if his package is detected as malicious and modify it until it isn't. Not something open source projects are keen on doing.

WD-42 1y ago

As Arch seemingly explodes in popularity I’m afraid we’ll start seeing more of this.

yuvadam 1y ago
Is arch exploding in popularity? Because of Omarchy or something else?
- Phelinofist 1y ago
  I think I saw posts on Reddit with XQC saying Arch is the best. I mean it is. And I use Arch btw.
  - kwk1 1y ago
    An evaluation of what's best really depends on how one weighs different tradeoffs. For example, Debian and Arch are basically polar opposites in terms of two questions: 1) do you want an intermediary between you and the upstream? for example, to patch out telemetry 2) is it important that what you're using continues to work the same way so you can focus on your actual work? No answer to either is consequence-free, e.g. for 1), see the Debian SSH patch event, or for 2), if the answer is "it doesn't work", then that kinda forces one's hand.
    - gpm 1y ago
      There's also the significant caveat with 2 that it's only "continues to work the same way" until everything changes all at once because you now need to update to the next version of Debian. The "everything changing all at once" thing is what eventually drove me to arch (as the most popular at the time rolling release distro - and more stable at the time than debian sid), I'd personally rather have smaller breaking changes more frequently. Though it's probably less painful now to update debian versions than it use to be because things generally work better without configuration than they used to.
- deleted 1y ago
  [deleted]

mzajc 1y ago

Any clue what these packages were 'supposed' to do or why somebody might have installed them? Their PKGBUILD descriptions are copies of the respective browsers', not explaining the -patched part.

Jorchime 1y ago
I wondered about the same thing. Not an answer, but my guess would be that it's just a new package and they hoped someone picked it up by accident? In that case, it was patched with malware :)
- Hackbraten 1y ago
  They (or someone in cahoots with them) made at least one attempt [0] to lure readers of the Arch Linux subreddit to the malicious PKGBUILD. IIRC, the post was just a single paragraph, praising how they “found” the zen-browser-patched-bin package on the AUR and how much it helped them. [0]: https://www.reddit.com/r/archlinux/comments/1m30py8/aur_is_so_awesome/ https://www.reddit.com/r/archlinux/comments/1m30py8/aur_is_s...
Vortigaunt 1y ago
Looks like someone archived the page of firefox-patch-bin[1] and the only thing that stands out about the package itself is that it's supposedly the "Extended Support Release." Besides that it looks like it's depended on by 183 other packages/metapackages. While that seems more interesting, there isn't an archive of all of those packages. [1]https://web.archive.org/web/20250718140411/https://aur.archlinux.org/packages/firefox-patch-bin https://web.archive.org/web/20250718140411/https://aur.archl...
- deleted 1y ago
  [deleted]
- mzajc 1y ago
  I saw the ESR part - I assumed the author (mistakenly?) copied firefox-esr's description. As for the dependents, it seems the malware package provided `firefox`, meaning all dependencies on `firefox` can instead be fulfilled by `firefox-patch-bin`. Perhaps the idea was to fool package managers into showing it as one of the alternatives.

jchoksi 1y ago

AUR packages are user-produced content i.e. packages built on their own machines. They have to be installed via "pacman -U package_file" Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package. VirusTotal's API is free. - https://docs.virustotal.com/docs/api-scripts-and-client-libraries https://docs.virustotal.com/docs/api-scripts-and-client-libr... - https://docs.virustotal.com/docs/please-give-me-an-api-key https://docs.virustotal.com/docs/please-give-me-an-api-key - https://docs.virustotal.com/docs/consumption-quotas-handled https://docs.virustotal.com/docs/consumption-quotas-handled Since it is end users who are doing the upload and virus scan check, there won't be a consumption quota issue with VirusToal. Lastly, "pacman -U" should flag failed VirusTotal scans to Arch Security. Arch's pacman and Flathub's flatpak package managers should be the last line of defence when installing untrusted packages by end users.

akerl_ 1y ago
Is this accurate? My understanding is that the AUR does not host binary packages. It hosts pkgbuild files, which contain config and scripts that a user has to build on their own machine in order to install. The malicious code here is fetched as part of those scripts.
- johnisgood 1y ago
  No, it is NOT accurate. Pacman cannot be used to download, compile, or install AUR packages. You need the PKGBUILD file and use "makepkg -si" at the very least. If you want AUR packages, you'd install a package manager (in this context referred to as AUR helper) like "yay" that supports both official and unofficial (i.e. AUR) packages. FWIW AUR helpers are not even official packages, not even "yay" which is a popular one. You need to go out of your way to install "yay" (although it is one command away before, i.e. very easy). TL;DR: Pacman does not download, compile, or install packages from the AUR, nor does it resolve their dependencies. "makepkg -si" builds and installs a package based on the PKGBUILD file, or use an AUR helper that overcomes the limitations of "makepkg". AUR helpers make it easy to install AUR (i.e. unofficial) packages.
  - 1y ago

defraudbah 1y ago

i installed a lot of cra* from aur in the past, wouldn't be surprised if i got a malware somewhere. Strange thing, I don't think open snitch would even help in such situation.. and official repo does not have enough packages to run arch :\ I don't want to go back to ubuntu

gus_ 1y ago
I haven't taken a look at the malware, but it seems to download files from the Internet so it should have warned you to allow/deny the outbound connections. It'd be nice to test it with a sample of aur package/malware.
- defraudbah 1y ago
  it does, I am using it extensively (little snitch on mac, and open snitch on linux). My problem with it is that every new tool wants to connect to the internet and my terminal is the constant source of outbound connections. I try to review everything but the amount of tools and connections is overwhelming. It does limit the risk, but i do not trust my terminal and dev tools as usually i give them way too many permissions and any plugin or tool from AUR can contain malware PS. Regarding downloading files from internet, every self-update tool does that nowadays, it becomes more common because of apple/others stores policies. I created a few remote control tools and it is very very difficult to caught them, and I am not even a professional malware researcher. Things they do is beyond understanding of average superuser

Barrin92 1y ago

There's always been this security theater of people recommending arch because they "don't trust the companies" or Canonical or what have you but frankly I'm surprised this hasn't happened sooner. Well or maybe it has and we don't know. Running random binaries on your computer uploaded by some anonymous dude has to be the equivalent of buying heart medicine on craigslist. And because Arch is so barebones to begin with the AUR is very popular, you see a lot of arch users using it.

h4ck_th3_pl4n3t 1y ago
Arch bugfix time is usually within 24 hours. Not a single enterprise distro even reacts within that timeframe. OVAL advisories are weeks, sometimes months later. As long as you don't have a virtualization approach similar to QubesOS, any linux distro will not fix this problem. Because that's not how separation of concerns works in the POSIX system. You need to have separate users for each and every program to isolate them, and that is practically unfeasible.
WD-42 1y ago
How exactly is Arch barebones? It basically ships with everything I need, more than most distros (Zed and Discord are good examples). I don't even need to use the AUR.
- Barrin92 1y ago
  Just by taking a glance at the most popular packages (https://aur.archlinux.org/packages https://aur.archlinux.org/packages) Pretty much every browser that isn't Firefox including Chrome, VS Code, most proprietary software like Slack, Zoom, Spotify, many vpn clients and password managers, a lot of them seemingly not published by the companies in question. All of those ancillary password, vpn or security related products who aren't going to be in the main repo because they have proprietary elements and also rely on random people seems particularly bad. And there's a lot of software in that category.
  - WD-42 1y ago
    And what distro does package those? That's what Flatpak is for. If you must install crappy proprietary software, at least get an official package from the developer.

christophilus 1y ago

Man. I am on Fedora, but I do have a handful of copr packages installed. (Copr is the Fedora analogue of the AUR.) This makes me nervous. I guess it’s time to do some audits.

lilly-lizard 1y ago

it should be noted that these are different from the popular librewolf-bin (513 votes) and zen-browser-bin (176). with this in mind it's cool that these got identified only 2 days after being uploaded. I wonder if the reporter actually intended to install it or just reads the PKGBUILDS of new packages to be a good samaritan...

Shellban 1y ago
I only just noticed the difference myself. That was a scare!

npteljes 1y ago

I wonder how popular these packages were. Librewolf and Firefox sure are popular, so this sounds scary, but for example searching for "firefox-patch-bin aur" yields no results, aside from sites talking about how it contained malware. My impression is that the malice was spotted timely, and not many people were affected. Which is a pretty good thing!

akerl_ 1y ago

It seems odd that this is just on the AUR mailing list, and it the homepage, the announce list, or the security list.

homebrewer 1y ago
Why would it be? AUR is user generated content by definition, you're expected to read and understand every package before using it, which is repeated in documentation ad nauseam. They're very, very explicit about this and that you're on your own when using AUR. All decent AUR helpers (which arch developers advise against using anyway) force you to read through the packaging script and confirm that you understand it and are fine with what's about to be executed. It's no more of an issue than someone posting a malware script into e.g. the wiki. Much less obscure than malware in npm or anything like that.
- akerl_ 1y ago
  This feels like a non-sequitur. Yes, the AUR is user-provided content. Yes, system administrators are responsible for being aware of what they’re installing. You can find many comments from me on this page discussing that. An attacker being detected using an official service hosted by Archlinux for user-managed packages to push malware is still noteworthy.
  - homebrewer 1y ago
    I guess we have very different takes on this; I wouldn't expect Slack or WhatsApp to publish security advisories if one of their users used them to spread malware among a tiny cohort of other users, which is about the right level of responsibility Arch places on itself (and it's very clear about this) w.r.t AUR.
    - akerl_ 1y ago
      I think you’re correct. I see a fundamental difference between services like slack and WhatsApp which provide messaging services and hosted platforms like the AUR where content is submitted and then republished on a site administered by the project.

RandyOrion 1y ago

Comments below is from the perspective of an arch Linux user, not maintainer or authors of some software. When installing softwares on arch Linux, first searching for official packages provided by Arch Linux maintainers, then official installation methods approved by authors of the software, or AURs which do the installation in the exact way as the authors of the software describe. A search on the default installation method of Firefox and librewolf package on arch Linux is listed below. If AUR is required to install a package, note that AURs are not trusted by default because not all AURs are not maintained by trusted users. Always check the source file and the installation method documented in PKGBUILD. Don't do the installation until EVERY line in the PKGBUILD is reasonable. https://wiki.archlinux.org/title/Firefox https://wiki.archlinux.org/title/Firefox https://librewolf.net/installation/arch/ https://librewolf.net/installation/arch/

michaelmrose 1y ago
This shouldn't reasonably be considered secure because it isn't altogether hard to obscure the nature of the attack until someone notices they are compromised.