Arch Linux disables AUR package adoption
摘要
Arch Linux DevOps 团队因 AUR 中出现大量恶意包收养及后续提交，宣布禁用对孤儿包的收养功能。攻击者通过新注册账户收养孤儿包并推送恶意更新，植入通过 Tor 接收指令并上传用户数据的远程访问木马（RAT）。此前 6 月项目曾暂停新账户注册，7 月 13 日重新开放但新增限制未见成效。
荐读理由
作为使用 Linux 的开发者，你应警惕 AUR 包收养机制的安全漏洞，避免盲目收养或安装来源不明的包；文中披露的 RAT 通过 Tor 通信并窃取数据，提示你在部署环境需加强包来源验证和审计。
原文
The Arch Linux DevOps team has announced that adoption of orphaned packages in the Arch User Repository (AUR) has been disabled due to "the current influx of malicious package adoptions and follow-up commits made via the AUR". Michael Taggart has posted a brief analysis of the malware being added to a long list of packages in this round of attacks. The payload appears to be an remote-access trojan (RAT) that takes commands over the Tor network and attempts to upload a wide range of user data.
The project had suspended new account registration in June. That followed a campaign in which an attacker or attackers created new accounts to adopt orphaned packages and push malicious updates to them that would install malware on user systems. AUR registration was reopened on July 13 after the DevOps team added some minor, and apparently ineffective, restrictions on creating new accounts.
Defence in Depth
Posted Jul 31, 2026 15:30 UTC (Fri) by davecb (subscriber, #1574) [Link]
这条对你有帮助吗？