Malicious Software Packages Found On Arch Linux User Repository

Summary: Arch Linux removed three packages from its community-run Arch User Repository after a user nicknamed "xeactor" adopted the orphaned acroread PDF viewer on June 7 and added code that downloaded a curl script from a remote server. That script installed and ran a persistent component every 360 seconds, interfered with systemd configuration, and posted collected system data to a Pastebin document before maintainers reverted the changes, suspended the account, and removed two other packages the same user had modified.
What's compelling: The malicious changes were caught by code analysis before serious damage, but the attacker could have swapped in more sophisticated payloads at any time - and the AUR team did not publicly name the other two packages it removed, so anyone who installed them has no way to know from the disclosure alone.

Read the original at The Hacker News ↗