ALERT Roughly 400 AUR packages compromised

[hecatae]

Aur-general - lists.archlinux.org

lists.archlinux.org

AUR REPORT THREAD - Aur-general - lists.archlinux.org

lists.archlinux.org

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread.

Reminds me of the Red Hat npm backdoor from 10 days ago:

Dozens of Red Hat packages backdoored through its official NPM channel

Anyone who has downloaded affected Red Hat packages should investigate immediately.

arstechnica.com