\u00c8 stata registrata una compromissione massiccia dei pacchetti nel repository AUR (Arch User Repository), utilizzato in Arch Linux per la distribuzione di applicazioni da sviluppatori esterni. Gli attaccanti hanno ottenuto il controllo su 469 pacchetti e sono riusciti a inserire codice dannoso per rubare password e chiavi di accesso dai sistemi degli utenti. Tra l'altro, il codice dannoso \u00e8 stato integrato nel pacchetto ALVR fornito attraverso AUR, popolare tra gli appassionati di videogiochi.<\/p>\n
Gli attaccanti hanno assunto il controllo dei pacchetti con lo stato «orphaned» e privi di accompagnatori. Come nome \u00e8 stato indicato quello dell'ultimo accompagnatore, ma con un'email diversa, dopo di che \u00e8 stato aggiunto un commit e pubblicato un aggiornamento. Il commit ha aggiunto «npm» all'elenco delle dipendenze di PKGBUILD e ha inserito nel blocco post_install dello script install.sh una riga per l'installazione di diversi pacchetti NPM. Tra i pacchetti NPM installati c'erano uno o pi\u00f9 pacchetti legittimi popolari e il pacchetto atomic-lockfile, contenente malware nascosto. L'aggiunta dell'installazione dei pacchetti NPM \u00e8 stata effettuata in tutti i progetti compromessi, anche se non utilizzavano JavaScript e NPM. <\/p>\n
Dopo l'attivazione, il malware si ancorava al sistema come servizio systemd con un nome casuale e si camuffava come flusso del kernel. Quando eseguito con privilegi root, il servizio veniva creato a livello di sistema (/etc/systemd/system) e attivava ulteriormente un rootkit funzionante a livello di kernel, mentre quando eseguito con i privilegi di un utente, veniva avviato a nome dell'utente (~/.config/systemd/user). Il malware eseguiva la scansione e inviava dati a un esterno. server<\/a> chiavi e credenziali VPN, Docker, Podman e SSH, nonch\u00e9 dati riservati estratti dal browser, storia dei comandi nel shell, chiavi dei portafogli delle criptovalute, token di accesso a Slack, Microsoft Teams, Discord, GitHub, NPM e Vault. \u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 469 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u0441\u043c\u043e\u0433\u043b\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432 \u043d\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u0441\u0438\u0441\u0442\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0421\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044b\u043b \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 AUR \u043f\u0430\u043a\u0435\u0442 ALVR, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182035","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Gli attaccanti hanno compromesso 469 pacchetti nel repository AUR | ProHoster","description":"\u00c8 stata registrata una compromissione massiccia dei pacchetti nel repository AUR (Arch User Repository), utilizzato in Arch Linux per la distribuzione di applicazioni da sviluppatori esterni.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 469 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 AUR (Arch User Repository), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Arch Linux \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/atakuyushhie-skomprometirovali-469-paketov-v-repozitorii-aur","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-06-12T12:48:21+00:00","article:modified_time":"2026-06-12T12:48:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/182035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=182035"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/182035\/revisions"}],"predecessor-version":[{"id":182071,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/182035\/revisions\/182071"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=182035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=182035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=182035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"