AUR Packages Compromised with Infostealer and Rootkit
Over 400 Arch User Repository (AUR) packages were compromised by a maintainer who injected malicious code, including an infostealer and an eBPF rootkit. Security researchers are currently working to remove the affected packages from the ecosystem.
Why it matters
This represents a significant supply chain attack targeting Linux users, demonstrating the risks associated with community-maintained software repositories.
It appears a new AUR package maintainer ( arojas ) adopted and infected 408+ packages. The compromise was reported and other AUR maintainers have been working to remove the infected packages.
The report is a technical summary of a cybersecurity incident without editorializing.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in