Over 400 AUR Packages Backdoored With Rust-Based Credential Stealer
Attackers rewrote build scripts in Arch's community repo to drop a secret-harvesting binary — with an eBPF rootkit waiting if it gets root.
Someone spent the week poisoning the Arch User Repository.
More than 400 AUR packages were taken over and their PKGBUILD scripts rewritten to fetch and install a Rust-compiled credential stealer at build time. Anyone who ran makepkg (or an AUR helper like yay or paru) against an affected package executed the payload as part of the normal build process.
The AUR is community-maintained. That distinction matters. It sits separately from the official Arch repositories, which are signed and curated by Arch's trusted user pool. AUR submissions are user-uploaded shell recipes — the trust model has always been "read the PKGBUILD before you build." Almost nobody does.
The payload is a Rust binary aimed at developer secrets: SSH keys, shell history, cloud credential files, browser-stored tokens, the usual harvest list. Exfil happens over the network once collection finishes. If the build was run with root (not unusual for system-level AUR packages that need privileged install steps), the malware additionally drops an eBPF component that functions as a rootkit, hiding processes and files from userland tooling. eBPF rootkits are a known and increasingly common post-exploitation pattern on Linux; defenders relying on ps, ls, or netstat to spot anomalies will not see what they expect.
The scale here — 400+ packages from what appears to be a coordinated push — suggests either a batch compromise of maintainer accounts or an automated upload campaign using fresh accounts to clone and trojanize popular packages. (At time of writing the AUR maintainers have not published a full post-mortem confirming the vector.)
If you've installed anything from the AUR in the last several days, assume credential exposure until proven otherwise.
What to do now:
- Pull a list of recently installed or updated AUR packages and diff their PKGBUILDs against upstream Git history. Anything with a newly added
curl,wget, or base64-blob inprepare()orbuild()is the tell. - Rotate SSH keys, cloud API tokens, and any credentials that lived on the build host. Revoke first, rotate second.
- On systems where AUR builds ran as root, treat the box as compromised. An eBPF rootkit is not something you clean in place — reinstall.
- Going forward, build AUR packages in a throwaway container or unprivileged user namespace, not on your daily driver.
This is not a vulnerability in Arch or in pacman. It's an abuse of a trust model that was always documented as "you are the reviewer." The community-repo supply chain remains one of the softest targets in Linux distribution, and Arch is not alone (see prior incidents in PyPI and npm).
Read your PKGBUILDs.
