LWN: Comments on "Malware found in the Arch Linux AUR repository"

Malware found in the Arch Linux AUR repository

XTerminator — Thu, 12 Jul 2018 12:15:05 +0000

It is not a surprise that a publically accessible repository contains malware. There is no vetting involved in creating an AUR account nor in submitting packages to it. AUR == caveat emptor. Always check what you are getting.

Packages affected

feb — Thu, 12 Jul 2018 11:50:20 +0000

That's a typosquatting attack which LWN talked about a few years ago (https://lwn.net/Articles/694830/). In the case of Arch AUR packages, there's also the idea of targetting orphaned packages.

Packages affected

jak90 — Wed, 11 Jul 2018 11:50:23 +0000

It seems "acrored" is a typo for the Adobe Reader package (acroread) that's sitting back at package version 9.5.5-7 (if one even dares to use this native version of the application, which is no longer supported by or officially available from Adobe).
Likewise, submitting "mistyped" packages would seem like a viable compromise vector as well.

Packages affected

rengolin — Wed, 11 Jul 2018 08:51:54 +0000

In case people are looking for, this is the list of the affected packages:
* acrored 9.5.5-8
* balz 1.20-3
* minergate 8.1-2

Source: https://lists.archlinux.org/pipermail/aur-general/2018-Ju...