Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

lists.archlinux.org

Post reply on HN
Print view View original

31–40 of 142 posts

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#31

Post by Vortigaunt »

mzajc wrote: post #14

Any clue what these packages were 'supposed' to do or why somebody might have installed them? Their PKGBUILD descriptions are copies of the respective browsers', not explaining the -patched part.

Looks like someone archived the page of firefox-patch-bin[1] and the only thing that stands out about the package itself is that it's supposedly the "Extended Support Release." Besides that it looks like it's depended on by 183 other packages/metapackages. While that seems more interesting, there isn't an archive of all of those packages.

[1]https://web.archive.org/web/20250718140411/https://aur.archl...

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#34

Post by johnisgood »

Ancapistani wrote: post #8
jabjq wrote: post #2

> We strongly encourage users that may have installed one of these packages […] to take the necessary measures in order to ensure they were not compromised. How are they supposed to do that when you give them no information as to what the malware does?

It's ArchLinux. The user is expected to do their own due diligence.

And these packages are from AUR, they are not officially supported. AUR means Arch User Repository. You cannot even use Arch Linux's official package manager to install AUR packages either, you need an AUR helper ("makepkg" is sufficient though but it has limitations). These AUR helpers are not even official packages either. Not even yay: https://archlinux.org/packages/?sort=&q=yay.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#35

Post by diggan »

rwmj wrote: post #3
jabjq wrote: post #2

> We strongly encourage users that may have installed one of these packages […] to take the necessary measures in order to ensure they were not compromised. How are they supposed to do that when you give them no information as to what the malware does?

Did you install one of those packages? If yes, nuke from orbit. More interesting questions are: - Who was the uploader? A packager? For how long? - Do they maintain other packages? - What steps can be taken to ensure that a similar problem doesn't happen in future?

They are/were AUR packages it seems, anyone can spend 2 minutes and upload essentially anything there, like npm and similar. It's not necessarily a "maintainer" per se, as like the people who manage the packages in the proper Arch repositories, but entirely separate.

With that comes the same warning as downloading random stuff from the internet and executing it, you need to carefully review everything before running/installing it, as you're basically doing a fancy version of "curl | bash" when using the AUR.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#36

Post by [deleted] »

Vortigaunt wrote: post #31
mzajc wrote: post #14

Any clue what these packages were 'supposed' to do or why somebody might have installed them? Their PKGBUILD descriptions are copies of the respective browsers', not explaining the -patched part.

Looks like someone archived the page of firefox-patch-bin[1] and the only thing that stands out about the package itself is that it's supposedly the "Extended Support Release." Besides that it looks like it's depended on by 183 other packages/metapackages. While that seems more interesting, there isn't an archive of all of those packages. [1] https://web.archive.org/web/20250718140411/https://aur.archl...

[deleted]

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#37

Post by diggan »

Tharre wrote: post #25
lorenzohess wrote: post #7

Could there be programmatic ways to help users characterize the safety of the AUR packages they install? Perhaps a program that prints all URLs in the PKGBUILD and offers the option for the user to open them in the browser? Or which automatically shows a diff if a PKGBUILD is updated? Highlighting changes would make it easier for the user to determine if he should spend time exploring those changes for malware. One c…

PKGBUILDs are just bash scripts following a certain function and variable naming convention. Even if you could somehow parse it safely and extract the URLs of the 'source' array, any attacker can just simply put an obfuscated version of the malware URL into the build() function and download it there. AUR clients already show you the diff if you update a package, but note that this were completely new packages anyway,…

> AUR clients already show you the diff if you update a package, but note that this were completely new packages anyway, uploaded 2 days ago, so that doesn't really apply here.

The program I use for AUR (Rua) still displays exactly what you're about to build (as a git diff), before you build it, even if it's the first time/release. I'd assume all the other "AUR managers" would work the same way?

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#38

Post by LeoPanthera »

ementally wrote: post #28
yuvadam wrote: post #16

Earlier quoted context omitted.

Is arch exploding in popularity? Because of Omarchy or something else?

CachyOS (Arch based distro), no.1 on https://distrowatch.com/

This is a slight aside, but CachyOS is a great example of the failure of Wikipedia politics.

The "CachyOS" page was deleted[1], and replaced with a redirect to the Arch Linux page. But CachyOS is not mentioned anywhere on that page, nor on the "List of Linux distributions § Arch Linux-based" page.

[1]: https://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletio...

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#39

Post by mzajc »

Vortigaunt wrote: post #31
mzajc wrote: post #14

Any clue what these packages were 'supposed' to do or why somebody might have installed them? Their PKGBUILD descriptions are copies of the respective browsers', not explaining the -patched part.

Looks like someone archived the page of firefox-patch-bin[1] and the only thing that stands out about the package itself is that it's supposedly the "Extended Support Release." Besides that it looks like it's depended on by 183 other packages/metapackages. While that seems more interesting, there isn't an archive of all of those packages. [1] https://web.archive.org/web/20250718140411/https://aur.archl...

I saw the ESR part - I assumed the author (mistakenly?) copied firefox-esr's description. As for the dependents, it seems the malware package provided `firefox`, meaning all dependencies on `firefox` can instead be fulfilled by `firefox-patch-bin`. Perhaps the idea was to fool package managers into showing it as one of the alternatives.

Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware

#40

Post by kiranet »

Tharre wrote: post #25
lorenzohess wrote: post #7

Could there be programmatic ways to help users characterize the safety of the AUR packages they install? Perhaps a program that prints all URLs in the PKGBUILD and offers the option for the user to open them in the browser? Or which automatically shows a diff if a PKGBUILD is updated? Highlighting changes would make it easier for the user to determine if he should spend time exploring those changes for malware. One c…

PKGBUILDs are just bash scripts following a certain function and variable naming convention. Even if you could somehow parse it safely and extract the URLs of the 'source' array, any attacker can just simply put an obfuscated version of the malware URL into the build() function and download it there. AUR clients already show you the diff if you update a package, but note that this were completely new packages anyway,…

LLMs are also really easy to trick, as we saw in the GMail white-on-white text PoC just a few days ago...
Post reply on HN