Re: Malicious package update - xsnow and xsnow-bin

[goeb]

On 2026-08-23 22:40, Saren wrote:
It downloads a lil executable called "systemmanager" from tor. I did 
not
need to analyze the binary or script to know this is malicious.
https://aur.archlinux.org/cgit/aur.git/tree/.xsnow.install?h=xsnow

https://aur.archlinux.org/cgit/aur.git/tree/.xsnow-bin.install?h=xsnow-bin

This install script also tries to spread to other AUR repos if run by a
maintainer. Might be a good idea to check for any .<package>.install 
files
across the AUR.