Hi,
I followed the advice from
https://thecybersecguru.com/news/atomic-arch-aur-supply-chain-attack-ebpf-rootkit/
[1].
I still have to check a second user account.
Right now, I'm trying to figure out where "fig-daemon.service" comes
from and why "go" in the home directory has strange permissions.
Any ideas?
$ /bin/ls /home/rocketmouse/go
ls: cannot open directory '/home/rocketmouse/go': Permission denied
$ sudo /bin/ls -hdltr /home/rocketmouse/go
d-w------- 3 rocketmouse rocketmouse 4.0K May 5 2019 /home/rocketmouse/go
$ sudo /bin/ls -hAltr /home/rocketmouse/go/pkg/mod
total 16K
drwxr-xr-x 4 rocketmouse rocketmouse 4.0K May 5 2019 cache
drwxr-xr-x 3 rocketmouse rocketmouse 4.0K Oct 17 2020 golang.org
drwxr-xr-x 4 rocketmouse rocketmouse 4.0K Jan 14 2024 gopkg.in
drwxr-xr-x 47 rocketmouse rocketmouse 4.0K Feb 4 2026 github.com
Regards,
Ralf
[1]
Just so you know: "ls" is an alias for a "ls" substitute, which is why
there are those strange characters.
$ ls -la /proc/*/exe 2>/dev/null | grep -v "Permission denied"
[snip]
lrwxrwxrwx rocketmouse rocketmouse 0 B Fri Aug 28 12:10:12 2026 /proc/10524/exe
⇒ /usr/bin/speech-dispatcher
[snip]
I guess I misremembered that this had something to do with the AUR
attacks, but it's actually from the extra repository.
$ sudo find /home -path "*/.config/systemd/user/*.service" -exec grep -l
"Restart=always" {} \;
[sudo] password for rocketmouse:
/home/rocketmouse/.config/systemd/user/fig-daemon.service
I don't know to what fig-daemon.service belongs to.
$ grep -r "Restart=always" /etc/systemd/system/
[empty]
$ grep -r "RestartSec=30" /etc/systemd/system/
[empty]
$ find /var/lib/ -type f -executable -newer /var/lib/dpkg/info 2>/dev/null
[snip]
$ sudo ls -la /sys/fs/bpf/
[empty]
$ ss -tlnp | grep 127.0.0.1
[nothing suspect]
$ sudo netstat -tlnp | grep 127.0.0.1
[nothing suspect]
$ sudo find /root/.npm -name "atomic-lockfile" -type d
[nothing]
$ ls ~/.npm/_cacache/*
/home/rocketmouse/.npm/_cacache/content-v2:
sha1 sha512
/home/rocketmouse/.npm/_cacache/index-v5:
00 08 10 18 20 28 30 38 40 48 50 58 60
68 70 78 80 88 90 98 a0 a8 b0 b8 c0 c8
d0 d8 e0 e8 f0 f8
01 09 11 19 21 29 31 39 41 49 51 59 61
69 71 79 81 89 91 99 a1 a9 b1 b9 c1 c9
d1 d9 e1 e9 f1 f9
02 0a 12 1a 22 2a 32 3a 42 4a 52 5a 62
6a 72 7a 82 8a 92 9a a2 aa b2 ba c2 ca
d2 da e2 ea f2 fa
03 0b 13 1b 23 2b 33 3b 43 4b 53 5b 63
6b 73 7b 83 8b 93 9b a3 ab b3 bb c3 cb
d3 db e3 eb f3 fb
04 0c 14 1c 24 2c 34 3c 44 4c 54 5c 64
6c 74 7c 84 8c 94 9c a4 ac b4 bc c4 cc
d4 dc e4 ec f4 fc
05 0d 15 1d 25 2d 35 3d 45 4d 55 5d 65
6d 75 7d 85 8d 95 9d a5 ad b5 bd c5 cd
d5 dd e5 ed f5 fd
06 0e 16 1e 26 2e 36 3e 46 4e 56 5e 66
6e 76 7e 86 8e 96 9e a6 ae b6 be c6 ce
d6 de e6 ee f6 fe
07 0f 17 1f 27 2f 37 3f 47 4f 57 5f 67
6f 77 7f 87 8f 97 9f a7 af b7 bf c7 cf
d7 df e7 ef f7 ff
*???*
$ sudo find / -type f -size 2961752c -exec sha256sum {} \; 2>/dev/null \
| grep 6144D433F8A0316869877B5F834C801251BBB936E5F1577C5680878C7443C98B
[nothing]
$ find ~/.npm /tmp /var/tmp -name "deps" -type f 2>/dev/null
[nothing]
I did not run cat ~/.cache/paru/clone/*, cat ~/.cache/yay/* as I don't use
(those) AUR helpers.
