As Arch seemingly explodes in popularity I’m afraid we’ll start seeing more of this.
FWIW this is AUR. These packages are not officially supported. AUR = Arch User Repository.
Plenty of package managers (such as `yay`) install from AUR by default.
Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
41–50 of 142 posts
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#42As Arch seemingly explodes in popularity I’m afraid we’ll start seeing more of this.
The only thing I've seen Arch exploding in popularity has been memes. It's a fun distro for hobbyists, but too inconvenient as a daily driver.
If Arch is too "inconvenient" as a daily driver, you might find yourself more at "home" on a Windows install instead.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#43Earlier quoted context omitted.
I think I saw posts on Reddit with XQC saying Arch is the best. I mean it is. And I use Arch btw.
An evaluation of what's best really depends on how one weighs different tradeoffs. For example, Debian and Arch are basically polar opposites in terms of two questions: 1) do you want an intermediary between you and the upstream? for example, to patch out telemetry 2) is it important that what you're using continues to work the same way so you can focus on your actual work? No answer to either is consequence-free, e.…
There's also the significant caveat with 2 that it's only "continues to work the same way" until everything changes all at once because you now need to update to the next version of Debian.
The "everything changing all at once" thing is what eventually drove me to arch (as the most popular at the time rolling release distro - and more stable at the time than debian sid), I'd personally rather have smaller breaking changes more frequently. Though it's probably less painful now to update debian versions than it use to be because things generally work better without configuration than they used to.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#44Any clue what these packages were 'supposed' to do or why somebody might have installed them? Their PKGBUILD descriptions are copies of the respective browsers', not explaining the -patched part.
Looks like someone archived the page of firefox-patch-bin[1] and the only thing that stands out about the package itself is that it's supposedly the "Extended Support Release." Besides that it looks like it's depended on by 183 other packages/metapackages. While that seems more interesting, there isn't an archive of all of those packages. [1] https://web.archive.org/web/20250718140411/https://aur.archl...
These 183 packages depend on "firefox", and the malicious firefox-patch-bin had a provides=( 'firefox' ) clause in it. That's why they all get listed on that page. The provides clause is useful when you have multiple packages for the same thing with different names, for example -bin and -git versions.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#45Earlier quoted context omitted.
Is arch exploding in popularity? Because of Omarchy or something else?
CachyOS (Arch based distro), no.1 on https://distrowatch.com/
That’s just a ranking of subpage hits per day. Not only is that easily gamed, it also says very little about how popular an OS really is.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#46AUR packages are user-produced content i.e. packages built on their own machines.
They have to be installed via "pacman -U package_file"
Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package.
VirusTotal's API is free.
- https://docs.virustotal.com/docs/api-scripts-and-client-libr... - https://docs.virustotal.com/docs/please-give-me-an-api-key - https://docs.virustotal.com/docs/consumption-quotas-handled
Since it is end users who are doing the upload and virus scan check, there won't be a consumption quota issue with VirusToal.
Lastly, "pacman -U" should flag failed VirusTotal scans to Arch Security.
Arch's pacman and Flathub's flatpak package managers should be the last line of defence when installing untrusted packages by end users.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#47Any clue what these packages were 'supposed' to do or why somebody might have installed them? Their PKGBUILD descriptions are copies of the respective browsers', not explaining the -patched part.
Looks like someone archived the page of firefox-patch-bin[1] and the only thing that stands out about the package itself is that it's supposedly the "Extended Support Release." Besides that it looks like it's depended on by 183 other packages/metapackages. While that seems more interesting, there isn't an archive of all of those packages. [1] https://web.archive.org/web/20250718140411/https://aur.archl...
[deleted]
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#48Earlier quoted context omitted.
PKGBUILDs are just bash scripts following a certain function and variable naming convention. Even if you could somehow parse it safely and extract the URLs of the 'source' array, any attacker can just simply put an obfuscated version of the malware URL into the build() function and download it there. AUR clients already show you the diff if you update a package, but note that this were completely new packages anyway,…
> AUR clients already show you the diff if you update a package, but note that this were completely new packages anyway, uploaded 2 days ago, so that doesn't really apply here. The program I use for AUR (Rua) still displays exactly what you're about to build (as a git diff), before you build it, even if it's the first time/release. I'd assume all the other "AUR managers" would work the same way?
They should all show you the PKGBUILD before building, yes.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#49As Arch seemingly explodes in popularity I’m afraid we’ll start seeing more of this.
The only thing I've seen Arch exploding in popularity has been memes. It's a fun distro for hobbyists, but too inconvenient as a daily driver.
Can you elaborate why you think this?
Personally I've been running Arch on my work machine for a few years now with very few issues. I'm not even very consistent with updates, and probably run them about once every 3 weeks on average. I have only had to manually intervene on a handful of occasions.
I like it a lot because everything is always up-to-date. I don't face any issues with unsupported versions for tools like I have with Debian in the past. The rolling release model also saves me the pain of doing a "hard" OS upgrade, which often come with issues.
Re: Firefox-patch-bin, librewolf-fix-bin AUR packages contain malware
#50i installed a lot of cra* from aur in the past, wouldn't be surprised if i got a malware somewhere. Strange thing, I don't think open snitch would even help in such situation..
and official repo does not have enough packages to run arch :\ I don't want to go back to ubuntu