Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
lists.archlinux.org
Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
1–10 of 142 posts
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#2> We strongly encourage users that may have installed one of these
packages […] to take the necessary
measures in order to ensure they were not compromised.
How are they supposed to do that when you give them no information as to what the malware does?
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#3> We strongly encourage users that may have installed one of these packages […] to take the necessary measures in order to ensure they were not compromised. How are they supposed to do that when you give them no information as to what the malware does?
Did you install one of those packages? If yes, nuke from orbit.
More interesting questions are:
- Who was the uploader? A packager? For how long?
- Do they maintain other packages?
- What steps can be taken to ensure that a similar problem doesn't happen in future?
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#4> We strongly encourage users that may have installed one of these packages […] to take the necessary measures in order to ensure they were not compromised. How are they supposed to do that when you give them no information as to what the malware does?
It says what the malware does, it's a remote access toolkit... It gives control of your machine to the malware operator.
The malware operator could have done anything with that access... There's no way for the maintainers to know what was done on any given infected machine.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#5> We strongly encourage users that may have installed one of these packages […] to take the necessary measures in order to ensure they were not compromised. How are they supposed to do that when you give them no information as to what the malware does?
Did you install one of those packages? If yes, nuke from orbit. More interesting questions are: - Who was the uploader? A packager? For how long? - Do they maintain other packages? - What steps can be taken to ensure that a similar problem doesn't happen in future?
Per the Wayback Machine the username used was danikpapas. As far as Google and duckduckgo know these are the only packages theat username ever uploaded. Considering the purpose was crime it's likely that that username was "stolen" and the person using it on other sites wasn't the same as the one doing this...
The AUR is arch's repository of untrusted user maintained read-the-source-before-installing packages. There's really not much that can be done to prevent similar issues in the future... because the whole purpose of the AUR is to allow random people to upload packages.
Arch doesn't ship with any way to install AUR packages other than downloading the tarball and building them locally. Tools for installing the packages usually force you to read the PKGBUILD that controls the build process (including getting sources) before letting you build the packages. I.e. the reasonable steps have already been taken.
Edit: firefox-patch-bin was first submitted to the AUR 2025-07-16 21:33 (UTC), so less than two days before removal.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#6Anyone have a copy of it that I can poke at in a virtual machine?
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#7Could there be programmatic ways to help users characterize the safety of the AUR packages they install? Perhaps a program that prints all URLs in the PKGBUILD and offers the option for the user to open them in the browser? Or which automatically shows a diff if a PKGBUILD is updated? Highlighting changes would make it easier for the user to determine if he should spend time exploring those changes for malware.
One could go even further and list all new commits, making it super easy for the user to check them. Maybe even integrate an LLM to help? Maybe commits from non long-time contributors could be flagged?
There has to be a way to help users programmatically review updates to their AUR packages. Even if most of them won't spend the time.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#8> We strongly encourage users that may have installed one of these packages […] to take the necessary measures in order to ensure they were not compromised. How are they supposed to do that when you give them no information as to what the malware does?
It's ArchLinux. The user is expected to do their own due diligence.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#9Could there be programmatic ways to help users characterize the safety of the AUR packages they install? Perhaps a program that prints all URLs in the PKGBUILD and offers the option for the user to open them in the browser? Or which automatically shows a diff if a PKGBUILD is updated? Highlighting changes would make it easier for the user to determine if he should spend time exploring those changes for malware. One c…
As one commentor pointed out, in Arch it's the user's responsibility to review any AUR packages BEFORE installing them (and I say this as an Arch user and AUR package maintainer).
This particular issue is with a binary (i.e. pre-built) package, normally in Arch it's expected from an AUR package that you will build it yourself and most if not all packagers prompt you to review and or edit the PKGBUILD before it does anything.
Basically you could spot something suspicious in a source package, not so much in a binary package.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#10> We strongly encourage users that may have installed one of these packages […] to take the necessary measures in order to ensure they were not compromised. How are they supposed to do that when you give them no information as to what the malware does?
It says what the malware does, it's a remote access toolkit... It gives control of your machine to the malware operator. The malware operator could have done anything with that access... There's no way for the maintainers to know what was done on any given infected machine.
Announcements like this typically contain information that will help users identify if they were compromised, such as the name of files that are dropped or modified when the malware is initialized, startup entry names, etc. Obviously the person with remote access can get in and manually start doing things on individual machines, but that doesn't mean there aren't indicators present from the programmatic actions the malware took before that point or on machines that weren't manually accessed.