CHAOS RAT

A reverse shell dressed as a Firefox patch

Inside the 2025 AUR compromise: how CHAOS RAT shipped in fake browser packages, why update automation made it worse, and how to audit PKGBUILDs in 30 seconds.