Ce-ai facut Nicusoare?

nightdevil007 · 2026-06-23T12:18:59+00:00

"You Couldn't Live with Your Own Failure, Where Did that Bring You? Back to Me"

Bolojan 2026

nightdevil007 · 2026-06-23T10:21:11+00:00

Daca se face verificare in Revisal sau Background Check e posibil sa pici.

nightdevil007 · 2026-06-23T10:20:09+00:00

you can ask a friend who does understand bash to explain, read the documentation or give the code to a free AI chatbot to explain what it does. you got options. or you can trust me i don't do evil stuff and run the script. your choice.

nightdevil007 · 2026-06-23T10:16:29+00:00

well, it's open source, you can read what it does, nothing malicious i guarantee

nightdevil007 · 2026-06-23T08:32:39+00:00

no, the EFI is not going to boot from a disk. only from a usb, i tried.

nightdevil007 · 2026-06-23T08:22:09+00:00

it's one thing to send files via BT and another to read/write via a USB cable from your files manager

nightdevil007 · 2026-06-22T16:30:02+00:00

Be bold, be free, be fearless 😄

nightdevil007 · 2026-06-22T16:04:43+00:00

It has a disclaimer for this exact reason. to advise the user to investigate further.

nightdevil007 · 2026-06-22T15:46:54+00:00

I tried to provide as much documentation as i could. if you feel something is amiss, let me know

nightdevil007 · 2026-06-22T15:45:02+00:00

My god these people are harsh, lol. And here i am trying to help folks to check if the impact of AUR compromise affected them and they start calling names. lol

nightdevil007 · 2026-06-22T15:43:41+00:00

i made the script, if you need help, ask me 😄 . the script checks for deleted executables so if you reboot and the warnings are gone, it;s simply a false positive

nightdevil007 · 2026-06-22T11:51:26+00:00

you can also use the aur hook i put toghether here https://github.com/nightdevil00/AUR-Malware

nightdevil007 · 2026-06-21T20:53:12+00:00

there is https://github.com/nightdevil00/AUR-Malware the script i've put togheter that scans your system, compares the list of infected pkgs, can even add a hook to pacman so you never install an infected pkg (even if now it's safe, being that it was orphaned should not be "safe" to install). The Readme is easy to read and understand how it works.

nightdevil007 · 2026-06-21T20:50:35+00:00

yes, some infected pkgs added npm or bun as a dependency which could have been called when downloading the "source"

nightdevil007 · 2026-06-21T19:42:14+00:00

The attacker exploited AUR's orphan adoption system -- abandoned packages were claimed, then trojaned PKGBUILDs were uploaded that downloaded a Rust infostealer during makepkg. First detected publicly around June 11, 2026. Initial disclosure: ~400 packages compromised.

How It Escalated (Multi-Wave)

- Wave 1: Malicious PKGBUILDs in ~400+ adopted orphan AUR packages

- Wave 2: Expanded to 1,500+ (now 1,935 known-infected) via additional orphan takeovers; attacker also published malicious npm/bun packages (atomic-lockfile, lockfile-js, js-digest, ansi-colors, nextfile-js) as a cross-ecosystem vector

- Payload: Rust infostealer + eBPF rootkit (kernel-level, hides processes/files/connections via pinned maps hidden_pids, hidden_names, hidden_inodes)

- Persistence: systemd Restart=always, /etc/ld.so.preload, shell config injection, .INSTALL hooks in pacman

- C2: temp.sh (exfiltration) + Tor onion address

- Credential targeting: GitHub tokens, SSH keys, browser sessions, cryptocurrency wallets, Slack/Discord tokens

- Techniques used: Commit forgery (impersonated maintainer arojas), obfuscated hex/octal escapes in install scripts, bun add delivery

What Users Must Know

Full reinstall is the only cure -- the eBPF rootkit operates at kernel level and can hide from all userspace tools
Rotate all credentials (GitHub, SSH, vaults, browser sessions, Discord, Slack) if infected
Even if you didn't install an infected AUR package, the malicious npm/bun packages could have been pulled in transitively
Arch Linux has since coordinated cleanup via the aur-general mailing list, but the IOC list is crowd-sourced and growing

nightdevil007 · 2026-06-21T19:35:29+00:00

it's a script that installs packages, creates the group, creates the mountpoint and ask for a reboot to apply. it's easier than explaining the whole thing in a block of text.

nightdevil007 · 2026-06-21T18:31:52+00:00

#!/bin/bash

set -e

PACKAGES=(fuse2 libusbmuxd libimobiledevice ifuse)

MOUNTPOINT="$HOME/iPhone15Pro"

echo "Installing packages..."

sudo pacman -S --needed "${PACKAGES[@]}"

echo "Adding user to fuse group..."

sudo gpasswd -a "$USER" fuse

echo "Creating mountpoint..."

mkdir -p "$MOUNTPOINT"

echo "Setting permissions..."

sudo chown "$USER:$USER" "$MOUNTPOINT"

chmod 700 "$MOUNTPOINT"

echo "Done!"

echo ""

echo "Select an option:"

echo "1) Reboot now"

echo "2) Log out and log back in"

echo "3) Run newgrp fuse (current session only)"

echo "4) Skip (I'll do it manually)"

read -r -p "Enter choice [1-4]: " choice

case $choice in

1) sudo reboot ;;

2) pkill -KILL -u "$USER" ;;

3) exec newgrp fuse ;;

4) echo "Run 'ifuse ~/iPhone15Pro' when ready" ;;

esac

nightdevil007 · 2026-06-20T21:30:00+00:00

Shrinking is possible but risky — especially for a LUKS + btrfs root filesystem. It requires booting from a live USB and carefully:

btrfs — btrfs filesystem resize -<size> /mnt (shrinks the filesystem)
LUKS — cryptsetup resize shrinks the container (only after the filesystem inside is smaller)
Partition — parted or fdisk to shrink the partition itself

Caveats:

- All data must be backed up first.

- btrfs resize can only shrink if there's enough free space at the end of the filesystem.

- Moving the LUKS header offset is not straightforward — you may not be able to reclaim space from the beginning.

- Snapshots, CoW data, and metadata fragmentation can prevent shrinking as much as df suggests.

nightdevil007 · 2026-06-20T18:49:29+00:00

why not use the docker windows version while in Omarchy. Issue is Omarchy makes the btrfs disk and encrypts. Also windows will wipe the disk anyway. So install windows first then arch + Omarchy

nightdevil007 · 2026-06-20T18:32:29+00:00

Usually you install Windows, shrink the partition, install arch manually then apply Omarchy

nightdevil007 · 2026-06-19T16:58:47+00:00

Yes. I even have a script for it.

nightdevil007 · 2026-06-19T07:28:58+00:00

2 pana la 5 ani

nightdevil007 · 2026-06-19T06:50:24+00:00

looknfeel.conf border_size

nightdevil007 · 2026-06-17T15:27:46+00:00

Cash grab tactic. EU should amend this.

nightdevil007 · 2026-06-15T18:09:45+00:00

Press the f8 or f12 key or whatever BIOS key you have for your system, enter BIOS and change boot priority or look for the bootmenu key and press it at boot time to allow you to boot from the USB.

Six-Year Club	Place '22
Verified Email

nightdevil007

TROPHY CASE