Supply Chain Attack Targets Arch Linux Community Repository
Arch Linux has temporarily suspended the adoption of packages in the Arch User Repository (AUR) after identifying a new wave of accounts taking over abandoned projects to insert malicious code. The measure was later expanded to block all new submissions to the AUR in an effort to contain supply chain attacks exploiting the community maintenance system.
In the AUR, users publish PKGBUILD files containing instructions to download, compile, and install programs not included in official repositories. Attackers were adopting packages without active maintainers and adding malicious modifications in later commits. Because these projects already had established history, recognizable names, and recurring users, the changes could go unnoticed during routine updates.
Security researchers also found newly created packages containing harmful commands executed during the build process, including requests for elevated privileges. The involved accounts have been banned and the identified projects removed from the repository.
The campaign can compromise systems when a user installs or updates a package without reviewing the PKGBUILD file. Depending on the added instructions, the process may download external files, execute commands, and alter the system. The incident does not directly affect packages distributed through official Arch Linux repositories. The risk remains concentrated in the AUR, where content is produced by the community and must be analyzed before installation.
Related articles
Malicious ZIP Archive Delivers Git-Based Remote Code Execution via Hooks and Filters
A developer received a fake job offer from Cryptic Heaven through LinkedIn, leading to a ZIP file containing a rigged Git repository. The archive included a pre-configured .git directory with altered hooksPath pointing to .git/objects/interrupt and a custom clean filter named ltr. Upon git status or branch checkout, the setup triggered a shell script that downloaded and executed remote code from a server hosted on vercelscript.vercel.app. The attack leveraged post-checkout hooks and Git filters to run silently without requiring install scripts or explicit execution. Multiple trigger paths existed, including automatic detection in Visual Studio Code, Git-aware terminal prompts, and following README instructions to switch branches. The technique worked on both Linux/macOS and Windows through Git for Windows shell support. The incident highlights risks of opening untrusted Git repositories delivered outside standard clone workflows.
OIDC-Based Push Deployment on VPS Removes SSH Keys from CI While Enforcing Strict Isolation
A new self-hosted deployment system called cd enables secure continuous delivery to single Linux VPS hosts running Docker without storing any long-lived secrets in CI repositories. The architecture relies on short-lived OIDC JWT tokens issued by GitHub Actions or GitLab CI, verified on the target server through JWKS public keys. The server component cdd performs token validation, archive checks, resource-limited builds inside BuildKit, health checks, and automatic rollback on failure. All containers are launched with read-only root filesystems, dropped capabilities, no-new-privileges, and network binding restricted to 127.0.0.1 behind Caddy or Nginx. Administrative control is provided by the cdctl CLI that registers projects, sets RAM/CPU limits, and manages DNS records via Porkbun integration. The entire solution avoids external databases, web panels, and persistent secrets while enforcing one-repository-to-one-application boundaries.
Stolen Credentials Poison cPGuard Update Channel, Turning Security Software into Data Theft Backdoor
Attackers used compromised OPSSHIELD credentials to hijack the cPGuard update distribution network on November 2 at 02:06 UTC, injecting malicious scripts into versions 5.88.12 through 5.88.19. The poisoned updates targeted Linux servers running the security tool, which holds root privileges on hosting provider and cloud infrastructure machines. The script harvested /etc/shadow, /etc/passwd, MariaDB/MySQL root credentials from my.cnf, root shell history containing API tokens, and SSH authorized_keys files before exfiltrating them via the vendor's own infrastructure. A persistent backdoor was also dropped at /var/tmp/.cpg91511_sh. OPSSHIELD detected the intrusion within 12 hours and halted distribution, but confirmed that 32 customer servers had their data accessed. The incident highlights risks of relying on static credentials for security product update pipelines without code signing or behavioral restrictions.
Polymarket Suffers Supply Chain Attack via Compromised DebugBear Monitoring Script
Attackers compromised DNS records of DebugBear, a real user monitoring provider, to inject malicious JavaScript into Polymarket pages. The script extracted wallet data and trading credentials from browser storage, then used the platform's official relayer to execute unauthorized withdrawals totaling approximately $2.7 million across 737 wallets. No smart contract vulnerabilities were exploited; all 985 unauthorized transactions carried valid user signatures. The incident occurred on October 29 and was resolved within an hour after trading was halted, with Polymarket returning $3.9 million including compensation. This attack class matches the 2023 Ledger Connect Kit compromise, highlighting risks from third-party scripts in browser sessions. Polymarket has since committed to stricter CSP policies, script pinning, and sandboxing. The case underscores that browser-based sessions with full API privileges remain a critical trust boundary in crypto platforms.