Apologies if this is the wrong address for such things. [storageexplorer-bin](https://aur.archlinux.org/pkgbase/storageexplorer-bin) contains a hidden copy of "optimizer".
While using Claude to build a tool to self-protect from the AUR malware, it discovered a probable hit on a malware entry that made it in. After looking at what the script is doing, I'm suspecting the current AUR entry is a phase one of a two phase attack plan where it's hiding the embedded optimizer binary's presence from scanners and will do an update later or use another path to activate. Thanks, David The Following text was generated by claude code: storageexplorer-bin currently has a stripped 43 KB x86-64 ELF executable named "optimizer" committed directly into its AUR git repository, together with a "source=( 'optimizer' )" line prepended to the top of the PKGBUILD. The binary and the modified PKGBUILD are still present as of 2026-08-03. The file name is one of the binary names listed in the recent collection thread about committed-binary packages, and the commit falls inside the same window, so this looks like the same activity rather than something unrelated. Details Package base: storageexplorer-bin AUR maintainer: lourencopaiva (account maintains this one package only) Commit: 031bed62f6455bf0abf3c7ece7ad91e0fa234936 Commit subject: "Fix deps" Commit author: Mohd Lee <[email protected]> Commit date: 2026-07-30 16:57:20 UTC AUR LastModified: 2026-07-30 16:57:25 UTC The repository contains exactly one commit, so the history appears to have been squashed or force pushed. The PKGBUILD's own "# Maintainer:" comment names a different person from the current AUR maintainer. The binary Path in repo: optimizer Git mode: 100755 Git blob: eb62d15a5b3dbe81546ecd32df02f32fca0222ea Size: 43640 bytes SHA256: 5bf2071c83872fc9b3fb3f664f4d3a376c811fc01e1656afc62632b2fac4f646 ELF BuildID: 783614d329a1c68ce33b4e433ff74bba7bc23672 Build stamp: GCC (GNU) 16.1.1 20260725 Type: ELF 64-bit LSB pie executable, x86-64, dynamically linked, stripped I did not run it. The following is from static inspection only (readelf, strings), and I have not reverse engineered the logic. Imported libc symbols include socket, connect, inet_addr, setsockopt and select, alongside fork, execl, dup2, pipe, system, waitpid and kill, plus setxattr, getxattr, geteuid and gethostname. The binary has only 126 extracted strings and no plaintext URL or host. Among the strings are "ExecStart=%s", "%s/%s/agent", "%s%s.done" and "Content-Length:". The ChaCha20/Salsa20 constant "expand 32-byte k" is present, but not as a contiguous string. It appears as inline immediate operands (movabs) beginning at file offset 13005, which is consistent with an inlined stream cipher rather than with a string constant. Taken together, the imports and those strings are consistent with a network client that spawns processes, redirects file descriptors and writes a systemd unit, with its configuration or traffic obscured. I am reporting the observable properties rather than asserting specific behaviour. One important caveat As currently committed, the injection does not appear to fire. The prepended "source=( 'optimizer' )" on line 1 is overwritten by the real source=() array further down the PKGBUILD, so makepkg does not stage the binary into $srcdir, and package() never references it. .SRCINFO also does not list "optimizer", so the AUR web view of the sources looks clean. In other words the payload is present and executable in the repository but the delivery is currently broken. A single corrected push would arm it, and the binary is in the repository of a package with a popularity of about 16, so I would rather report it now than wait. Suggested actions - Review and remove the committed binary and the prepended source line. - Review the lourencopaiva account, given the single package pattern and the push timestamp shortly after adoption was disabled. - Consider whether other packages touched in the same window carry similarly named binaries. I found this one while checking package repositories for committed ELF files rather than for known names, and it does not appear in any of the package name lists circulating so far. Reproduction git clone https://aur.archlinux.org/storageexplorer-bin.git cd storageexplorer-bin git ls-files -s file optimizer sha256sum optimizer head -1 PKGBUILD
