75
Malicious AUR Checkup Script. (Not a silver bullet, but it helps) (discuss.cachyos.org)
submitted 3 months ago* (last edited 3 months ago) by to c/linux@lemmy.world
15 comments fedilink hide all child comments
 

All credit to Cscs https://discuss.cachyos.org/u/cscs/summary

you are viewing a single comment's thread
view the rest of the comments
[–] 51 points 3 months ago (8 children)

Thanks for sharing.

But, please stop using the curl command piped into a terminal pattern. Malicious actors have been abusing the fuck out of this pattern ever since the idiots at Anthropic decided that would be the official install pattern for Claude. I've been cleaning up infections based on people just blindly running shit like that constantly over the last couple months.

Folks, never run a random script from the internet, without being sure what you are actually about to run. If using AUR packages is considered risky. Random scripts being piped into a terminal ranks right up there with sticking your dick in a blender.

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
  • [–] 24 points 3 months ago* (1 child)

    Longer than that. In particular, a malicious server can detect when a script is being viewed or downloaded vs being piped to a shell, and can serve something different. https://web.archive.org/web/20250622061208/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 16 points 3 months ago (2 children)

    Random scripts being piped into a terminal ranks right up there with sticking your dick in a blender.

    Excellent imagery.

    And so true.

    And I'm guilty of it myself, even though I know better.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 3 months ago

    This is so stupid but really hard to avoid. Before I had a gz link and I knew I'd download, check Sha or signature, export path and ready.

    Tried installing antigravity and it's this stupid thing. So I downloaded a large script, read a lot of it, didn't find something easy to put together to figure out what binary to download. Took me quite some time to install something that should have taken 2 minutes.

    Ah and I'm told it auto upgrades. Great, now I have a back door too.

    Replace this tool with basically anything, because pages don't have download links anymore. Soon there will be nothing published in curated repos like brew, nix, debían etc

  • permalink
  • fedilink
  • source
  • parent