Hi, just saw the new wave of AUR package take-over events flowing in. The mails read like they'd be similar attacks with the extra "validator" binary (sometimes named differently, such as 'assembler', 'optimizer') in the build step.
I collected what I grabbed out of the list so far here: https://github.com/lenucksi/aur-malware-check/issues/52 One user reported an additional one https://aur.archlinux.org/packages/meshcore-open-git with the malware called 'optimizer'. Would it be possible to create list like the one for the last campaign on the pastebin so I can use it with the tool? Also, another user of the original openconnect-sso apparently threw the dropper onto Claude leading to this: https://claude.ai/share/d8111b00-156c-405b-9faf-85631176092b (via https://aur.archlinux.org/packages/openconnect-sso#comment-1080202). Has anyone got a SHA256 (or a set of those) of those various attack payloads or any more detailed analysis of it, possibly with IoCs or post-attack traces to scan for with the tool above? I considered a scan for the weird localhost ports+adresses mentioned by the Clauded 'analysis' but without knowing what it actually leaves behind when it seemed a bit premature. Another question: Since this attack seems to mostly target the build() step, not the preinstall step, would a chrooted build have reduced the blast radius? On the last one, that clearly wasn't the case. If so, would it be wise to follow the route with the chroot'd AUR builds as default more? Cheers, Lenucksi --
