Arch Linux AUR Reports Russian Spam and Profanity in Over 70 Packages
The Arch Linux User Repository (AUR) is reportedly experiencing a new issue, with over 70 packages modified to insert Russian spam and profane messages into users' shell configuration files. This development follows closely after a separate incident where more than 1,500 AUR packages were found to contain malware. The questionable messages, detected by Nicolas Boichat's AI/LLM detection bot, were added post-installation to configuration files such as bashrc, zshrc, and Fish config. The affected packages include various Python, Ruby, and Llama.cpp components.
The Arch Linux User Repository (AUR) is currently facing reports of a new security concern. This issue involves more than 70 AUR packages that have allegedly been modified to inject Russian spam and profane content directly into users' shell configuration files.
Reports indicate that these messages are being added post-installation to critical shell configuration files, including bashrc, zshrc, and Fish config. The commits responsible for these modifications reportedly occurred on June 14.
Nicolas Boichat, utilizing an AI/LLM detection bot, identified the appearance of these problematic messages within AUR content. The affected packages span various categories, including Python and Ruby packages, as well as Llama.cpp.
This incident follows a recent discovery where over 1,500 AUR packages were found to be carrying malware. The AI/LLM bots are reportedly proving useful in proactively detecting such abuses within the AUR.
According to Phoronix, as reported by Slashdot, the situation with Russian spam and profanities affects dozens of AUR packages.
