Arch Linux has recently identified and removed three malicious packages from its Arch User Repository (AUR) that were designed to install Remote Access Trojans (RATs) on users’ systems. The compromised packages—firefox-patch-bin, librewolf-fix-bin, and zen-browser-patched-bin—were uploaded by a user under the handle ‘dlagents’ and masqueraded as legitimate browser updates.
These packages contained modified installation scripts that downloaded and executed a shell script from a malicious GitHub repository. This script established persistence by creating a systemd service named rat-agent.service, which opened encrypted reverse shells on port 443, allowing unauthorized remote access to the infected systems.
The Arch Linux security team acted swiftly, removing the malicious packages within 48 hours of their upload. Users who installed any of these packages are strongly advised to uninstall them immediately and check for the presence of the rat-agent.service. Additionally, it’s recommended to rotate credentials and perform thorough system audits to detect any signs of compromise.
This incident underscores the importance of vigilance when using community-maintained repositories. While AUR offers a vast array of packages, users should exercise caution by verifying package integrity, checking maintainers’ credibility, and monitoring for unusual system behavior. Implementing security best practices, such as verifying PGP signatures and confining AUR builds to isolated containers, can help mitigate the risks associated with supply chain attacks.
