Hello, For those who wish to report the IPs, the network is key is
tskey-auth-kcwhmDB9NJ11CNTRL-rRHNtAJHsm2uFeWa5ULYm2EuSokKLTgd and the IP is 100.70.123.108. An alternative key is tskey-auth-kdAWerBrpm11CNTRL-4vutNBSRnZX13SDEeoaaZX9fGPAYBaeh! At least according to the GitHub repository On Friday, August 28th, 2026 at 3:06 PM, [email protected] <[email protected]> wrote: > Have you reported the IPs and Tailscale network to tailscale's abuse team? > > On August 28, 2026 8:02:13 PM UTC, Saren <[email protected]> wrote: > >This package contains a real config of hyprland but it blatantly opens > >up a backdoor for the attacker: > > > >1. lures user to type sudo password in post-install, and then do > >following 2-5 without user's permissions > > > >2. installs Tailscale and OpenSSH (--noconfirm), then joins the > >attacker's Tailscale network (--ssh) to bypass firewalls and grant > >remote shell access > > > >3. adds an attacker ed25519 key to three locations and spawns two root > >sshd instances on ports 3333/4444. Uses fake Arch systemd service names > >to disguise config files in /etc/pacman.d/ > > > >4. installs SUID-root binaries to three paths (/etc, /usr/lib, > >/usr/bin), triggered hourly by an un-stoppable systemd timer. Grants > >wheel users passwordless sudo execution > > > >5. configures UFW to allow SSH ports and Tailscale IP 100.70.123.108. > >Wipes systemd logs (journalctl --vacuum-time=1s), disables shell > >history, and clears /root and user .bash_history > > > > > >Package URL: https://aur.archlinux.org/packages/hyprland-fixes > > > >Package source repo: https://github.com/iusearch-hyprlandbtw/hyprland-fixes > > > >Source repo snapshot: > >https://drop.wtako.net/file/22927ab5f074e4fafe959de72bb55db7768e1654.zip > >(password: "backdoor" [8 characters] > > > > >
publickey - [email protected] - 0x4D40E687.asc
Description: application/pgp-keys
signature.asc
Description: OpenPGP digital signature
