Another Wave of AUR Malware

Lawl Another wave of AUR malware might be coming Seemingly malicious AUR package found. Where to report? A sudden update to pgadmin4-server.git added a binary named "parser" and executes using sudo. It's very obvious. this also adds a binary named "optimizer" but PKGBUILD didn't execute and no ::install also fuck fuck fuck another wave openconnect-sso Wrapper script for OpenConnect supporting Azure AD (SAML v2) authentication Red Flags (4): Binary executable found (ELF): validator Source URL points to "PrestonHagler/openconnect-sso" instead of the official "vivapiconnect-sso", indicating a potential supply chain attack or impersonation. (PKGBUILD) Build function executes a bundled binary (validator) with sudo privileges, which is highly unusual for a Python package build and suggests privilege escalation or hidden payload execution. (PKGBUILD) Binary strings reveal network capabilities (socket, connect, inet_addr) and command execution (system, execl), inconsistent with a simple validation utility and suggesting potential data exfiltration or remote control. (validator (binary strings)) act-runner-binscanner A runner for Gitea Actions based on GitHub's Act Red Flags (1): Binary executable found (ELF): splitter

На изображении пост с Arch Linux обсуждает подозрительные AUR-пакеты, содержащие бинарные файлы и выполняющие команды с sudo. Автор в панике пишет «fuck fuck fuck another wave», намекая на новую волну вредоносных пакетов и возможную атаку на цепочку поставок. Мем используют как реакцию на повторяющиеся проблемы безопасности в AUR. EN: The image shows an Arch Linux post discussing suspicious AUR packages containing binary files and executing commands with sudo. The author panics with “fuck fuck fuck another wave,” implying a new wave of malicious packages and a possible supply-chain attack. The meme is used as a reaction to recurring security problems in the AUR.

• @gentoomemes / 21518 2026-07-29