[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRrOv_TRTvmcX3RMUfINzvnmrFy1PMAWOXADoi1j9u58":3},{"article":4,"iocs":49,"watch_terms":58,"solutions":59,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"5112b654-888a-4e3c-934c-1ef4e9c55e15","Arch Linux disables AUR package adoption to stop malware flood","arch-linux-disables-aur-package-adoption-to-stop-malware-flood-67fd5b","The Arch Linux project has temporarily disabled adoption of Arch User Repository (AUR) packages after a surge in malicious takeovers of existing packages. [...]","Arch Linux has temporarily disabled the adoption of new Arch User Repository (AUR) packages following a significant increase in malicious takeovers. Attackers are compromising existing packages to distribute a two-stage stealer malware with RAT and SSH worm capabilities, targeting sensitive data like browser credentials and API keys.","Arch Linux disables AUR package adoption due to a surge in malicious takeovers.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Farch-linux-disables-aur-package-adoption-to-stop-malware-flood\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F07\u002F18\u002Farch-linux-white.jpg","2026-07-31T21:38:08+00:00","2026-07-31T22:00:26.546232+00:00",8,[17,20,23],{"name":18,"type":19},"AUR","product",{"name":21,"type":22},"Arch Linux","vendor",{"name":24,"type":25},"ACR Stealer attacks","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,53,56],{"type":30,"value":51,"context":52},"stealer malware","Second-stage payload targeting sensitive data",{"type":30,"value":54,"context":55},"rootkit","Previously distributed via AUR packages",{"type":30,"value":57,"context":52},"info-stealer",[21,18],{"controls":60,"vendors":147},[61,90,118],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":48,"name":91,"problem":92,"products":93},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":119,"name":120,"problem":121,"products":122},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":161},"malicious-aur-package-takeovers-highlight-open-source-supply-chain-risks","Malicious AUR Package Takeovers Highlight Open-Source Supply Chain Risks","Attackers exploited the AUR package adoption process to hijack legitimate, trusted packages and inject two-stage stealer malware capable of stealing browser credentials, API keys, and establishing persistent SSH worm access. This incident illustrates a classic supply chain attack: rather than targeting end users directly, adversaries compromise a trusted distribution channel to reach a wide audience with minimal suspicion. The open, community-driven nature of AUR, while a strength for collaboration, creates an attack surface when package ownership transitions lack sufficient vetting. This matters because developers and system administrators who blindly trust community repositories can inadvertently deploy malware across production systems at scale.",[153,154,155,156,157,158,159,160],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST CSF ID.SC-4: Suppliers and third-party partners are routinely assessed","SLSA Supply Chain Levels for Software Artifacts (Framework)","GDPR Article 32: Security of processing (where credential data of EU users is involved)",{}]