• Petersson@feddit.org
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      8 hours ago

      Have a check if you updated it recently (PKGBUILD history, about June 10-12). If not you’re fine.

      If:

      • Rotate all credentials — browser passwords, SSH keys, API tokens, and cloud access keys
      • Scan for suspicious processes masquerading as kernel threads using tools like rkhunter or chkrootkit (E: It’s supposed to be an eBPF rootkit)

      (reference)

      Personally I would reset everything if I got anything, to kill both any infection and my paranoia. Then reset credentials.

      • StarDreamer@lemmy.blahaj.zone
        link
        fedilink
        English
        arrow-up
        3
        ·
        7 hours ago

        libgdata here is specifically very messy. It was an official package since it was a required dependency for older versions of GNOME, then in GNOME 50 they dropped the dependency and so did Arch from their repos. But because pacman doesn’t remove dangling dependencies, you end up with libgdata still installed, until Arch Linux moves dropped packages into the AUR as an orphan, which happened in this case 5/31. This allowed it to be perfectly timed for the attackers to pick it up on 6/11. Now, you’d inadvertently update libgdata from an AUR source if you’re using an AUR helper.