Linux - Tag - Coding braindumphttps://dev-initely.me/tags/linux/Linux - Tag - Coding braindumpHugo -- gohugo.ioenFri, 26 Jun 2026 08:13:00 +0200Improving security of using AUR packages: paru, devtools chroothttps://dev-initely.me/posts/tools/aur-hardening-paru-chroot/Fri, 26 Jun 2026 08:13:00 +0200mor3dr3adhttps://dev-initely.me/posts/tools/aur-hardening-paru-chroot/Recently a malicious AUR package used a npm dependency (atomic-lockfile) to compromise systems. What was insidious about the attack was that it was more indirect than installing a simple backdoor: the PKGBUILD looked clean, instead the payload was in a transitive npm dependency.

That means it was very hard to detect (I certainly do not check all AUR dependencies) and it ran silently during the install phase. The incident was a good opportunity to have a closer look at my own setup.

]]>AUR Supply Chain Attack: How to check your (Arch Linux) Systemhttps://dev-initely.me/posts/aur-supply-chain-attack/Sat, 13 Jun 2026 05:55:00 +0200mor3dr3adhttps://dev-initely.me/posts/aur-supply-chain-attack/The supply chain attacks on linux just keep coming: in June 2026, a malicious package was discovered in the Arch User Repository (AUR). I first read about this in ioctl.fail. Here is what happened in the short version (for long version go to ioctl.fail).

An attacker masked a binary by hiding it in the dependency tree of (the legitimate package) atomic-lockfile (v1.4.2). The hidden binary runs at install time via an npm hook. It is designed to steal credentials, installs a persistent systemd service and loads an eBPF rootkit to hide itself and exfiltrates everything over Tor. All silently - so this is pretty advanced stuff.

]]>