> ## Content Index
> Fetch the complete content index at: https://itsfoss.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Arch Linux Users at Risk Again as AUR Hit by Another RAT
- URL: https://itsfoss.com/news/arch-linux-spark-rat/
- Published: 2025-08-01T11:14:51.000Z
- Updated: 2025-08-04T05:09:11.000Z
- Description: A new pest appears in the Arch User Repository.
- Author: Sourav Rudra
- Tags: Development Updates, News, #Import 2025-11-08 21:15

The [Arch User Repository](https://itsfoss.com/aur-arch-linux/?ref=news.itsfoss.com) (*AUR*) is a popular resource for Arch Linux users. It hosts user-submitted build scripts for software not included in the official repositories. While its openness provides flexibility, it also introduces vulnerabilities.

Merely a few weeks ago, [AUR was hit by a RAT](https://itsfoss.com/arch-linux-chaos-rat/) that disguised itself inside browser-related packages. It infected systems during the install process using a malicious GitHub link embedded in the PKGBUILD script.

Now, a similar case has emerged, where a new package pretending to be Google Chrome has been caught carrying another [hidden RAT script](https://github.com/XZB-1248/Spark?ref=itsfoss.com).

**What's Happening:** A file named `google-chrome-stable` had made its way into the AUR, uploaded by a newly created user account called "[*forsenontop*](https://aur.archlinux.org/account/forsenontop?ref=itsfoss.com)", who had no other activity other than this.

According to Linuxiac, the package used an `.install` script to run a Python command that downloaded and executed remote code each time the Chrome browser was launched. The code runs silently in the background, with no visible signs to the user.

Luckily, **the package was quickly removed by AUR admins** once [it was reported](https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/thread/GHPZL7D6ASQRCDIJBXBYTVAPJKUN3MJV/?ref=itsfoss.com) by a user.

**What Now:** Like earlier, if you suspect that you might be affected, then you can first run the following command to see whether the malicious package is on your system:

```
pacman -Qs google-chrome-stable
```

If this package shows up in your system, then remove it immediately with:

```
sudo pacman -Rns google-chrome-stable
```

📋

****Keep in mind**: Removing the package only deletes the software itself. It may not fully eliminate any malicious files or processes left behind. If you installed or updated this package recently, consider checking your system for suspicious activity or restoring from a clean backup.  
  
**Updated on August 4, 2025, at 05:10 UTC.*

And I will say this again: **always make sure your system is up to date and only install packages from trusted sources**.

Via: [Linuxiac](https://linuxiac.com/arch-aur-under-fire-once-more-as-malware-resurfaces/?ref=itsfoss.com)

**Suggested Read** 📖

[Someone Slipped a RAT into Arch Linux!A sneaky menace made its way into Arch User Repository. Another reminder to not blindly trust packages from AUR, PPA and even from Snapcraft.![](https://itsfoss.com/content/images/icon/android-chrome-192x192-174.png)It's FOSS NewsSourav Rudra![](https://itsfoss.com/content/images/thumbnail/chaos-rat-malware-arch-linux.png)](https://itsfoss.com/arch-linux-chaos-rat/)