Malware in Arch Linux AURs now inserting Russian spam into shell configs
摘要
开发者在 AUR 仓库中发现大量软件包（涉及 llama.cpp 相关组件、alist-desktop-bin 等）的 PKGBUILD 被篡改。这些恶意代码会修改 bash 或 zsh 配置文件，导致 shell 启动时输出俄语垃圾信息。目前 Arch 维护者正在清理恶意提交并封禁相关账户，建议用户检查受影响的包列表并关注官方修复进展。
荐读理由
若你在 AI 开发中使用 Arch Linux，需对照文中列表核查环境是否安装了受污染的 AUR 包（含 llama.cpp 相关变体），以规避 shell 配置文件被注入恶意脚本的供应链风险。
原文
Re: AUR REPORT THREAD
Sid Karunaratne
14 Jun 2026 14 Jun '26
6:03 p.m.
Not exactly malicious, but definitely spam. Using the github AUR repo: In all these cases it adds to bash/zsh etc shell configs to echo spam, in russian, on start. $ while read ref; do git grep --files-with-matches 'NoServices' $ref; done < <( git refs list --format '%(refname)' ) | grep -Po '(?<=refs/remotes/origin/).*' | sort | tee NoServices.txt algobox alist-desktop-bin arpoison asymptote-git aurbs blackfire-cli ccsm-git chinadns closure-hib cmaptools cypher-shell daggerfall-fixes dbacl docan-bin docan-unstable emacs-evil enyo-launcher esy faudio-git findwild gbdk gnome-pomodoro-git hidapi-git hypatia infer kicadlibrarian libdmx libparserutils-git llama.cpp-sycl-f16-git nikto-git nodejs-serverless nodejs-uglifycss nullfs-dkms-git onivim2-git onvifviewer pcb pcmanx-gtk2-git perl-xml-filter-domfilter-libxml pfqueue pgdbf plasma-theme-helium plataro-icons pngrim-git proteus-hib psychopy purple-gowhatsapp python-cmake-bin python-graphsrv python-imagebackup python-json2html python-llama-cpp-hip python-monkeytype python-pytest-filedata python-tmpl redocly rigsofrods-bin ruby-open_uri_redirections ruby-snapsync samsung-ssd-dc-toolkit scd softmaker-office-2012-bin spacebar-client-git spacebar-git swig2 systemtap-git tapeutape thomaswasalone-hib ttf-dotsies tuwunel-git ultimatevocalremovergui-git vaping vim-railscasts zenta-git (It was always in PKGBUILD, so I removed the ":PKGBUILD" from the output) On Thu, 11 Jun 2026, at 13:47, Jonathan Grotelüschen wrote:
...
Hi everyone,
we’re working hard to reset/delete all malicious commits and ban the accounts.
If you find more malicious packages, please send them as a reply to this email to keep them all in one thread.
Thanks!
-- tippfehlr
Attachments: • OpenPGP_signature.asc
Attachments:
- attachment.html (text/html — 2.9 KB)
这条对你有帮助吗？