{"id":182035,"date":"2026-06-12T14:48:20","date_gmt":"2026-06-12T12:48:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur"},"modified":"2026-06-12T14:48:20","modified_gmt":"2026-06-12T12:48:21","slug":"atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","title":{"rendered":"Angribere har kompromitteret 469 pakker i AUR-repositoriet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Der er registreret en massiv kompromittering af pakker i AUR (Arch User Repository), der anvendes i Arch Linux til distribution af applikationer fra tredjepartsudviklere. Angriberne fik kontrol over 469 pakker og kunne inds\u00e6tte skadelig kode til at stj\u00e6le adgangskoder og adgangsn\u00f8gler fra brugernes systemer. Blandt andet var den skadelige kode integreret i den gennem AUR leverede pakke ALVR, der er popul\u00e6r blandt gamere.<\/p>\n

Angrebene p\u00e5tog sig ledsagelse af pakker, der havde status som «orphaned» og var tilbage uden ledsagere. Som navn blev det sidste ledsagerens navn angivet, men med en anden email, hvorefter der blev tilf\u00f8jet et commit og offentliggjort en opdatering. Commit'en tilf\u00f8jede «npm» til listen over afh\u00e6ngigheder i PKGBUILD og indsatte i post_install-blokken af install.sh-scriptet en linje til installation af flere NPM-pakker. Blandt de installerede NPM-pakker var der \u00e9n eller flere popul\u00e6re legitime pakker og pakken atomic-lockfile, der indeholdt skjult skadelig software. Installation af NPM-pakker blev udf\u00f8rt i alle kompromitterede projekter, selvom de ikke anvendte JavaScript og NPM. <\/p>\n

Efter aktivering forankrede det skadelige software sig i systemet som en systemd-tjeneste med et tilf\u00e6ldigt navn og camouflage som en kernestr\u00f8m. Ved k\u00f8rsel med root-rettigheder blev tjenesten oprettet p\u00e5 systemniveau (\\\/etc\\\/systemd\\\/system) og aktiverede yderligere en kerneniveau rootkit, mens den ved udf\u00f8relse med brugerrettigheder blev startet i brugernavnet (~\\\/ .config\\\/systemd\\\/user). Det skadelige software foretog scanning og sendte til ekstern server<\/a> n\u00f8gler og legitimationsoplysninger til VPN, Docker, Podman og SSH, samt fortrolige data udvundet fra browseren, kommandohistorik i shell, n\u00f8gler til kryptovaluta-tegneb\u00f8ger, adgangstokener til Slack, Microsoft Teams, Discord, GitHub, NPM og Vault.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 469 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432 \u043d\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0421\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044b\u043b \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 AUR \u043f\u0430\u043a\u0435\u0442 ALVR, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182035","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Angriberne kompromitterede 469 pakker i AUR | ProHoster","description":"Der er registreret en massiv kompromittering af pakker i AUR (Arch User Repository), der anvendes i Arch Linux til distribution af applikationer fra tredjepartsudviklere.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 469 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-12T12:48:21+00:00","article:modified_time":"2026-06-12T12:48:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/182035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=182035"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/182035\/revisions"}],"predecessor-version":[{"id":182071,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/182035\/revisions\/182071"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=182035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=182035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=182035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}