Hundreds of Malicious Packages with Rootkit Found in Arch Linux Repository

Cybersecurity experts have uncovered a large-scale campaign distributing malware in the Arch User Repository (AUR). Attackers embedded a rootkit and infostealer in over 400 packages, designed to steal credentials and access tokens from Linux users. The threat primarily impacts those who frequently use unofficial sources for software installation.

Security researchers note that the attack succeeded due to the lack of strict moderation in AUR. Unlike official repositories, where packages undergo rigorous checks, AUR allows any user to upload code, creating an environment ripe for malware distribution.

The malicious packages were disguised as legitimate applications, making detection difficult. The infostealer harvested data from browsers, messengers, and other applications, while the rootkit ensured covert execution of malicious code with superuser privileges. Experts advise users to verify package checksums and deploy antivirus solutions for Linux.

Arch Linux developers have already removed the infected packages from the repository, but the threat may persist for users who previously installed the malware. It is recommended to audit installed packages and consider a system reinstall if necessary.