Habe nach dem letzten Vorfall komplett aufgehört AUR zu verwenden.

Liste weitere betroffene Pakete aus den Kommentaren:

fuck fuck fuck another wave openconnect-ssoscanned0.8.1-1

Wrapper script for OpenConnect supporting Azure AD (SAMLv2) authentication 30m 🔴 Red Flags (4): • Binary executable found (ELF): validator • Source URL points to ‘PrestonHager/openconnect-sso’ instead of the official ‘vlaci/openconnect-sso’, indicating a potential supply chain attack or impersonation. (PKGBUILD) • Build function executes a bundled binary (‘validator’) with ‘sudo’ privileges, which is highly unusual for a Python package build and suggests privilege escalation or hidden payload execution. (PKGBUILD) • Binary strings reveal network capabilities (socket, connect, inet_addr) and command execution (system, execl), inconsistent with a simple validation utility and suggesting potential data exfiltration or remote control. (validator (binary strings)) act-runner-binscanned0.2.13-1 A runner for Gitea Actions based on GitHub’s Act 28m 🔴 Red Flags (1): • Binary executable found (ELF): splitter 🟡 Yellow Flags (1): • Binary included in PKGBUILD source but NOT installed in package() function. Contains network-related functions (socket, connect, inet_addr, setsockopt) and has GCC version string showing future date (GCC 16.1.1 20260725), which is suspicious for an unused binary (splitter)

replay-sorceryscanned0.6.0-3

Open-source, instant-replay solution for Linux 35m 🔴 Red Flags (2): • Binary executable found (ELF): formatter • Executes pre-compiled binary ‘formatter’ with sudo during build phase. Running unverified binaries with elevated privileges during package build is unusual and could hide malicious activity or privilege escalation. (PKGBUILD) 🟡 Yellow Flags (3): • Package adopted by danielneves (was orphaned) • Pre-compiled binary included in package source without clear upstream provenance. Contains network-related functions (socket, connect, inet_addr, setsockopt) which are unexpected for a video replay tool and could indicate hidden network communication. (formatter) • Binary compiled with GCC version showing future date ‘16.1.1 20260725’. This suggests potential tampering, fake binary, or system clock manipulation - warrants verification of binary authenticity. (formatter) 1panelscanned2.1.10-0 1Panel, a modern open source linux panel. 34m 🔴 Red Flags (2): • Binary executable found (ELF): assembler • Executes an unknown binary (‘assembler’) with sudo privileges during the build phase. The binary contains networking symbols (socket, connect, inet_addr) and a suspicious future GCC timestamp (20260725), indicating potential hidden payload, backdoor, or supply-chain attack. (PKGBUILD)

1panel-gitscanned2.0.8.r121.g5c59042-6

1Panel, a modern open source linux panel. 33m 🔴 Red Flags (2): • Binary executable found (ELF): serializer • Executes unverified compiled binary ‘serializer’ with sudo during build process. Binary contains network-related functions (socket, connect, inet_addr) and has suspicious GCC version metadata showing future date (20260725), indicating potential tampering or malicious payload. (PKGBUILD) 🟡 Yellow Flags (1): • npm install executed without package-lock.json verification, creating potential supply chain attack vector for frontend dependencies. (PKGBUILD)

zed-binscanned1.12.1-1

A high-performance, multiplayer code editor from the creators of Atom and Tree-sitter 32m 🔴 Red Flags (2): • Binary executable found (ELF): optimizer • Unexplained binary file present in package but not referenced or installed by PKGBUILD. Binary contains network-capable functions (socket, connect, inet_addr, setsockopt) and has a future GCC timestamp (20260725), suggesting potential hidden payload or supply-chain tampering. (optimizer) 🟡 Yellow Flags (1): • Package orphaned (was maintained by knight731)

Geil genau was wir gebraucht haben… Zum Glück nutze ich AUR kaum.