Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

Post by WD-42 » Fri, Jul 18, 2025, 6:36 PM UTC

lorenzohess wrote: post #7

Could there be programmatic ways to help users characterize the safety of the AUR packages they install? Perhaps a program that prints all URLs in the PKGBUILD and offers the option for the user to open them in the browser? Or which automatically shows a diff if a PKGBUILD is updated? Highlighting changes would make it easier for the user to determine if he should spend time exploring those changes for malware. One c…

Post by akazantsev » Fri, Jul 18, 2025, 6:45 PM UTC

sp0rk wrote: post #10

gpm wrote: post #4

Earlier quoted context omitted.

It says what the malware does, it's a remote access toolkit... It gives control of your machine to the malware operator. The malware operator could have done anything with that access... There's no way for the maintainers to know what was done on any given infected machine.

Announcements like this typically contain information that will help users identify if they were compromised, such as the name of files that are dropped or modified when the malware is initialized, startup entry names, etc. Obviously the person with remote access can get in and manually start doing things on individual machines, but that doesn't mean there aren't indicators present from the programmatic actions the m…

Post by gpm » Fri, Jul 18, 2025, 6:54 PM UTC

sp0rk wrote: post #10

gpm wrote: post #4

Earlier quoted context omitted.

It says what the malware does, it's a remote access toolkit... It gives control of your machine to the malware operator. The malware operator could have done anything with that access... There's no way for the maintainers to know what was done on any given infected machine.

Announcements like this typically contain information that will help users identify if they were compromised, such as the name of files that are dropped or modified when the malware is initialized, startup entry names, etc. Obviously the person with remote access can get in and manually start doing things on individual machines, but that doesn't mean there aren't indicators present from the programmatic actions the m…

Post by techjamie » Fri, Jul 18, 2025, 6:55 PM UTC

heavyset_go wrote: post #6

Anyone have a copy of it that I can poke at in a virtual machine?

Post by mzajc » Fri, Jul 18, 2025, 6:56 PM UTC

techjamie wrote: post #17

heavyset_go wrote: post #6

Anyone have a copy of it that I can poke at in a virtual machine?

You might be able to poke at the PKGBUILD on the wayback machine and see if the original sources work.