Slashdot Mirror

← Back to Stories (view on slashdot.org)

Malware Found in Arch Linux AUR Package Repository (bleepingcomputer.com)

Posted by msmash on from the security-woes dept.

An anonymous reader shares a report: Malware has been discovered in at least three Arch Linux packages available on AUR (Arch User Repository), the official Arch Linux repository of user-submitted packages. The malicious code has been removed thanks to the quick intervention of the AUR team. The incident happened because AUR allows anyone to take over "orphaned" repositories that have been abandoned by their original authors. On Saturday, a user going by the pseudonym of "xeactor" took over one such orphaned package named "acroread" that allows Arch Linux users to view PDF files. According to a Git commit to the packag's source code, xeactor added malicious code that would download a file named "~x" from ptpb [dot] pw, a lightweight site mimicking Pastebin that allows users to share small pieces of texts.

1 of 69 comments (clear)

  1. A rare photo of a malware author being born. by AlanObject · · Score: 3, Interesting

    From the looks of it the bad actor xeactor didn't have any expectation beyond finding out if his little trick would work or not.

    On the other side this could be a case study about the immune system that open source provides.