400+ Arch User Repository packages have been compromised in a massive, sophisticated supply chain attack, including a rootkit installation.
https://discourse.ifin.network/t/400-aur-packages-compromised-with-infostealer-and-rootkit/577
#ThreatIntel #ThreatIntelligence #IFIN
IFIN - The Independent Federated Intelligence Network
npub1qm…nh363
2026-06-12 04:36:44 UTC
Author Public Key
npub1qm4tytdmranfklywc562p7gprs702mzkc4usqv6t8ja3d340evpslnh363Seen on
wss://relay.momostr.pinkPublished at
2026-06-12 04:36:44 UTCEvent JSON
{
"id": "53abebaed18e94e01bd94db6ed4fcfa8aa6bf3ca907c331fcc89e0bc50ac0762",
"pubkey": "06eab22dbb1f669b7c8ec534a0f9011c3cf56c56c57900334b3cbb16c6afcb03",
"created_at": 1781239004,
"kind": 1,
"tags": [
[
"t",
"threatintelligence"
],
[
"t",
"ifin"
],
[
"t",
"threatintel"
],
[
"proxy",
"https://infosec.exchange/@ifin/116735279416101129",
"web"
],
[
"proxy",
"https://infosec.exchange/ap/users/115741367687413652/statuses/116735279416101129",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/115741367687413652/statuses/116735279416101129",
"pink.momostr"
],
[
"-"
]
],
"content": "400+ Arch User Repository packages have been compromised in a massive, sophisticated supply chain attack, including a rootkit installation.\n\nhttps://discourse.ifin.network/t/400-aur-packages-compromised-with-infostealer-and-rootkit/577\n\n#ThreatIntel #ThreatIntelligence #IFIN",
"sig": "2246edc6f9f4fe92f8f450d83784f6b98d1925dd529b604117adec385215d520076fb96945156e43173e6c30600911fe3adcf7b774ef7507dad02a365e0237ce"
}