Another Malware Wave Hit Arch Linux's AUR

Summary of the video (Auto-generated subtitles)

• New AUR malware/spam wave reported: The video explains that another round of malicious activity has hit Arch Linux’s AUR, following a prior “spam wave” and mitigation efforts that the speaker argues were insufficient.

Previous mitigations described (from earlier wave)

• Disposable email addresses rejected
• Email verification made mandatory
• New AUR accounts must verify via a 24-hour token
• Email changes locked during the verification cooldown

Despite these measures, the speaker states the problem was not fully resolved.

Discovery of malicious “info stealer” packages

• First highlighted incident: an AUR package (reported on Reddit) that:
  • adds a binary (named “pasa”), and
  • executes it via pseudo

The speaker presents this behavior as a strong indicator of maliciousness.

• The speaker emphasizes: if you installed it, that’s a problem—and the issue wasn’t a one-off. About 200 more similar malicious packages were reportedly found shortly after.

Attack pattern matches the previous wave (spam/adoption abuse)

A few days earlier, attackers allegedly used AUR mechanics to introduce malware by:

• creating or controlling accounts
• filing “out of date” reports
• filing author (or orphan/adoption) requests to take over packages

Once adopted, the attacker can upload modified package contents to inject malware.

Why the “out of date” reporting mattered

• The speaker notes the AUR interface likely lacks the ability to misuse certain steps “for good reason,” but attackers still succeeded through the adoption workflow.
• The speaker references community discussion where moderators rejected some adoption requests, but the attacker(s) were still able to proceed elsewhere.

Evidence/claims about automation and account generation

• The accounts involved appear to be random/nonsense-named, suggesting automation (scripts/bots/agents).
• The speaker says it may be possible some accounts were compromised—though no specific compromise is confirmed.

Real-world typosquatting and SEO amplification

Many malicious packages look like:

• typo-squatted names (e.g., “Brave origin” variants)
• suspicious -bin or unusual suffixes (often not how legitimate packages are normally structured)

The AUR’s strong search/SEO is highlighted: malicious variants may show up at the top in search results.

Fixing is difficult and requires manual review

• The speaker argues this is not just a simple “grep for a known bad script” situation.
• Many different injected payloads were described (e.g., pasa, and later patterns such as minifier, encryptor, renderer, translator).
• As a result, moderators must review changes across many commits and adoptions.

AUR maintainership and orphaning process blamed as a weakness

The video argues the system for handling orphaned packages/adoption needs rethinking:

• adoption approval should likely involve trusted maintainers or stronger moderator gating
• orphaned package adoption should require a chain of authorization (not just account-initiated requests)

It also calls for stricter rules around typosquatting, especially unusual suffixes (example style cited: -ash getit-b-type names).

Concrete mitigations taken during this incident (AUR temporarily locked down)

According to a mailing list post (attributed to Robin Kandu), the AUR:

• disabled package adoptions
• later also disabled pushes entirely
• and disabled registrations and other request actions

This effectively puts the system in read-only mode until the issue is contained.

Users are urged to:

• report suspicious commits/adoption events
• stay vigilant

Additional notable timing commentary

• The speaker mentions it’s possibly unrelated but interesting timing that Morton Linderude (Foxboron) announced his resignation from the Arch Linux project, speculating burnout may contribute to security/maintenance strain.

Broader perspective: this will happen again without process changes

• The speaker asserts AUR compromise risk is systemic and will likely repeat whenever registrations/adoptions/pushes reopen unless adoption and verification systems improve.
• Mentions “Chaotic AUR” (a build/filter layer by trusted maintainers) as a safer alternative for users who don’t want to review packages themselves.

Final advice

• During the incident: do not blindly trust AUR helper tools
• Verify what you’re installing, especially newly adopted or newly appearing packages.

---

Presenters / Contributors

• Presenter (main): Ara (referenced by the speaker: “that’s going to be it for me and Ara”)
• Named contributor referenced in the report: Robin Kandu
• Named project/community figure referenced: Morton Linderude (Foxboron)
• Referenced third-party service: Chaotic AUR (no individual named in subtitles)