4 ms·
You might be able to poke at the PKGBUILD on the wayback machine and see if the original sources work.
by techjamie 1y ago
You might be able to poke at the PKGBUILD on the wayback machine and see if the original sources work.
- mzajc 1y agoThe PKGBUILDs are not archived, but the package page does helpfully list its sources, one of which is https://github.com/danikpapas/zenbrowser-patch.git https://github.com/danikpapas/zenbrowser-patch.git (same for all three packages). I would assume that's where the malware is, but I couldn't find an archive. Does https://www.gharchive.org/ https://www.gharchive.org/ keep this sort of data? ETA: According to a Reddit post linked elsewhere in this thread, the payload was a binary file downloaded by a python script in the repository. It has been uploaded to VirusTotal, but downloading requires a premium subscription according to their docs: https://www.virustotal.com/gui/file/d9f0df8da6d66aaae024bdca26a228481049595279595e96d5ec615392430d67 https://www.virustotal.com/gui/file/d9f0df8da6d66aaae024bdca...