{"id":139649,"date":"2025-07-19T11:11:57","date_gmt":"2025-07-19T09:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety"},"modified":"2025-07-19T11:11:57","modified_gmt":"2025-07-19T09:11:57","slug":"v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety","title":{"rendered":"Des packages malveillants ont \u00e9t\u00e9 d\u00e9tect\u00e9s dans le d\u00e9p\u00f4t AUR d'Arch Linux.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dans le r\u00e9f\u00e9rentiel AUR (Arch User Repository), utilis\u00e9 dans Arch Linux pour la distribution de paquets par des d\u00e9veloppeurs tiers, trois paquets malveillants firefox-patch-bin, librewolf-fix-bin et zen-browser-patched-bin ont \u00e9t\u00e9 identifi\u00e9s, contenant des versions modifi\u00e9es des navigateurs Firefox, Librewolf et Zen. Les noms des paquets ressemblaient \u00e0 des paquets l\u00e9gitimes firefox-bin, librewolf-bin et zen-browser-bin, soutenus par des passionn\u00e9s dans l'AUR. <\/p>\n

Dans les paquets du fichier PKGBUILD, il y avait un lien vers des correctifs t\u00e9l\u00e9charg\u00e9s depuis des r\u00e9f\u00e9rentiels externes sur GitHub (zenbrowser-patch, youtube-viewbot). Les correctifs apportaient une modification au processus d'installation, entra\u00eenant l'ex\u00e9cution d'un script en Python pour installer le cheval de Troie Chaos. Ce cheval de Troie permettait d'acc\u00e9der \u00e0 distance au syst\u00e8me, d'envoyer des fichiers confidentiels et d'ex\u00e9cuter des commandes, par exemple pour miner des cryptomonnaies. serveur<\/a> Le fichier ex\u00e9cutable malveillant \u00e9tait plac\u00e9 sous \/usr\/local\/share\/systemd-initd et \u00e9tait lanc\u00e9 \u00e0 l'aide du service custom-initd.service, copi\u00e9 dans le r\u00e9pertoire avec systemd. En l'absence de droits root lors de l'installation, le cheval de Troie \u00e9tait plac\u00e9 dans le r\u00e9pertoire personnel de l'utilisateur (~\/.local\/share\/systemd-initd). <\/p>\n

Les paquets malveillants ont \u00e9t\u00e9 diffus\u00e9s dans le r\u00e9f\u00e9rentiel AUR le 16 juillet vers 23 heures (MSK). Pour promouvoir ces paquets malveillants, une campagne de spam a \u00e9t\u00e9 lanc\u00e9e le 18 juillet \u00e0 15 heures (MSK). Par exemple, pour inciter \u00e0 l'installation, une mention dans le commentaire de la version du navigateur Zen faisait \u00e9tat de la r\u00e9solution de probl\u00e8mes critiques de stabilit\u00e9 et de rendu, ainsi que de l'\u00e9limination des fuites de m\u00e9moire. <\/p>\n

Les paquets ont \u00e9t\u00e9 supprim\u00e9s par les administrateurs du r\u00e9f\u00e9rentiel le 18 juillet \u00e0 19 heures (MSK). Presque imm\u00e9diatement, les utilisateurs du r\u00e9f\u00e9rentiel ont remarqu\u00e9 quatre autres paquets malveillants minecraft-cracked, ttf-all-ms-fonts, ttf-ms-fonts-all et vesktop-bin-patched, publi\u00e9s sous un autre compte vers 21 heures le 18 juillet (MSK). Au moment de la r\u00e9daction de cette nouvelle, ces paquets avaient d\u00e9j\u00e0 \u00e9t\u00e9 supprim\u00e9s du r\u00e9f\u00e9rentiel.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430 firefox-patch-bin, librewolf-fix-bin \u0438 zen-browser-patched-bin, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432 Firefox, Librewolf \u0438 Zen. \u0418\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u043b\u0438 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b firefox-bin, librewolf-bin \u0438 zen-browser-bin, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u044d\u043d\u0442\u0443\u0437\u0438\u0430\u0441\u0442\u0430\u043c\u0438 \u0432 AUR. \u0412 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0432 \u0444\u0430\u0439\u043b\u0435 PKGBUILD \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043f\u0430\u0442\u0447\u0438, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-139649","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Des paquets malveillants identifi\u00e9s dans le r\u00e9f\u00e9rentiel AUR d'Arch Linux | ProHoster","description":"Dans le r\u00e9f\u00e9rentiel AUR (Arch User Repository), utilis\u00e9 dans Arch Linux pour la distribution de paquets par des d\u00e9veloppeurs tiers, trois paquets malveillants firefox-patch-bin, librewolf-fix-bin et.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 AUR-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Arch Linux \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b | ProHoster","og:description":"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u0430 firefox-patch-bin, librewolf-fix-bin \u0438.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-aur-repozitorii-arch-linux-vyyavleny-vredonosnye-pakety","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-07-19T09:11:57+00:00","article:modified_time":"2025-07-19T09:11:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"139649","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:54:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:54:19","updated":"2026-01-23 13:54:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/139649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=139649"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/139649\/revisions"}],"predecessor-version":[{"id":173101,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/139649\/revisions\/173101"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=139649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=139649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=139649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}