Researcher Finds More Sophisticated Arch AUR Malware Using Gemma E2B AI
Updated
Updated · Phoronix · Jun 15
Researcher Finds More Sophisticated Arch AUR Malware Using Gemma E2B AI
3 articles · Updated · Phoronix · Jun 15
Summary
Hours after one malware wave was removed, Nicolas Boichat found another set of malicious Arch Linux AUR packages using a local Gemma E2B AI model.
The new samples were described as more elaborate, hiding malicious behavior through heavier obfuscation around the Bun command.
Developer a821 had earlier flagged infected Node.js packages, a Plasma 6 applets package, Firefox-related packages, the Aura browser, LibreWolf extensions, a NeoVim plug-in and other packages, which were then taken down.
The back-to-back discoveries deepen concerns over AUR’s user-submitted package model and pressure Arch to add stronger verification or temporary safeguards.