{"id":139649,"date":"2025-07-19T11:11:57","date_gmt":"2025-07-19T09:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety"},"modified":"2025-07-19T11:11:57","modified_gmt":"2025-07-19T09:11:57","slug":"v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety","title":{"rendered":"Se han detectado paquetes maliciosos en el repositorio AUR de Arch Linux.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En el repositorio AUR (Arch User Repository), utilizado en Arch Linux para la distribuci\u00f3n de paquetes de desarrolladores externos, se han identificado tres paquetes maliciosos: firefox-patch-bin, librewolf-fix-bin y zen-browser-patched-bin, que contienen versiones modificadas de los navegadores Firefox, Librewolf y Zen. Los nombres de los paquetes se asemejaban a los paquetes leg\u00edtimos firefox-bin, librewolf-bin y zen-browser-bin, mantenidos por entusiastas en AUR. <\/p>\n

Los paquetes en el archivo PKGBUILD conten\u00edan un enlace a parches que se descargaban de repositorios externos en GitHub (zenbrowser-patch, youtube-viewbot). Los parches modificaban el proceso de instalaci\u00f3n, lo que provocaba la ejecuci\u00f3n de un script en Python para instalar el troyano Chaos. El troyano permit\u00eda el acceso remoto al sistema, enviando archivos confidenciales al exterior. servidor<\/a> y ejecutando comandos, por ejemplo, para la miner\u00eda de criptomonedas. El ejecutable malicioso se ubicaba en \/usr\/local\/share\/systemd-initd y se iniciaba mediante el servicio custom-initd.service, copiado en el directorio de systemd. En ausencia de privilegios de root durante la instalaci\u00f3n, el troyano se ubicaba en el directorio personal del usuario (~\/.local\/share\/systemd-initd). <\/p>\n

Los paquetes maliciosos fueron subidos al repositorio AUR el 16 de julio aproximadamente a las 23:00 (MSK). Para promover estos paquetes maliciosos, el 18 de julio a las 15:00 (MSK) se implement\u00f3 una campa\u00f1a de spam. Por ejemplo, para estimular la instalaci\u00f3n, se destac\u00f3 en la nota de la construcci\u00f3n del navegador Zen la soluci\u00f3n a problemas cr\u00edticos de estabilidad y renderizado, as\u00ed como la eliminaci\u00f3n de fugas de memoria. <\/p>\n

Los paquetes fueron eliminados por los administradores del repositorio el 18 de julio a las 19:00 (MSK). Casi de inmediato, los usuarios del repositorio notaron otros cuatro paquetes maliciosos: minecraft-cracked, ttf-all-ms-fonts, ttf-ms-fonts-all y vesktop-bin-patched, subidos bajo otra cuenta alrededor de las 21:00 del 18 de julio (MSK). Al momento de redactar esta noticia, dichos paquetes ya han sido eliminados del repositorio.
\n
Fuente: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430 firefox-patch-bin, librewolf-fix-bin \u0438 zen-browser-patched-bin, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 Firefox, Librewolf \u0438 Zen. \u0418\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u043b\u0438 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b firefox-bin, librewolf-bin \u0438 zen-browser-bin, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u044d\u043d\u0442\u0443\u0437\u0438\u0430\u0441\u0442\u0430\u043c\u0438 \u0432 AUR. \u0412 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0432 \u0444\u0430\u0439\u043b\u0435 PKGBUILD \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043f\u0430\u0442\u0447\u0438, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-139649","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Se han identificado paquetes maliciosos en el repositorio AUR de Arch Linux | ProHoster","description":"En el repositorio AUR (Arch User Repository), utilizado en Arch Linux para la distribuci\u00f3n de paquetes de desarrolladores externos, se han identificado tres paquetes maliciosos: firefox-patch-bin, librewolf-fix-bin y.","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 AUR-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Arch Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b | ProHoster","og:description":"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430 firefox-patch-bin, librewolf-fix-bin \u0438.","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-07-19T09:11:57+00:00","article:modified_time":"2025-07-19T09:11:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"139649","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:54:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:54:19","updated":"2026-01-23 13:54:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/139649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=139649"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/139649\/revisions"}],"predecessor-version":[{"id":173101,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/139649\/revisions\/173101"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=139649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=139649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=139649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}