Highly suspicious unofficial Brave Origin package on AUR
Good day everyone, I was getting a new laptop setup and found this package published just today to AUR: https://aur.archlinux.org/packages/brave-origin It includes an ELF binary called "translator" in the sources, though it's unclear if it has an execution path currently enabled. I believe the brave-origin-bin package to be published by brave themselves, so this one looks like it's just trying to fool users. Any way you slice it, it's very suspicious and is worth a review. I'm having Claude dig into the binary to see what it can find. Regards, Jared
Il 31/07/26 17:31, Jared Sutton ha scritto:
Good day everyone,
I was getting a new laptop setup and found this package published just today to AUR:
https://aur.archlinux.org/packages/brave-origin <https:// aur.archlinux.org/packages/brave-origin>
It includes an ELF binary called "translator" in the sources, though it's unclear if it has an execution path currently enabled. I believe the brave-origin-bin package to be published by brave themselves, so this one looks like it's just trying to fool users.
Any way you slice it, it's very suspicious and is worth a review. I'm having Claude dig into the binary to see what it can find.
Regards, Jared
Hi, I have submitted a deletion request at 17.06 and it has been accepted at 17.26
On Friday, July 31st, 2026 at 10:07 AM, Jared Sutton <jpsutton@gmail.com> wrote:
Good day everyone,
I was getting a new laptop setup and found this package published just today to AUR:
https://aur.archlinux.org/packages/brave-origin
It includes an ELF binary called "translator" in the sources, though it's unclear if it has an execution path currently enabled. I believe the brave-origin-bin package to be published by brave themselves, so this one looks like it's just trying to fool users.
Any way you slice it, it's very suspicious and is worth a review. I'm having Claude dig into the binary to see what it can find.
Regards, Jared
It has already been dealt with: https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/t...
Hi team, Does the list also include malware?
Brave origin Nightly bin Because i use Brave origin Nightly bin
On Sat, Aug 1, 2026 at 1:47 AM Mark Wagie <mark.wagie@proton.me> wrote:
On Friday, July 31st, 2026 at 10:07 AM, Jared Sutton <jpsutton@gmail.com> wrote:
Good day everyone,
I was getting a new laptop setup and found this package published just today to AUR:
https://aur.archlinux.org/packages/brave-origin
It includes an ELF binary called "translator" in the sources, though it's unclear if it has an execution path currently enabled. I believe the brave-origin-bin package to be published by brave themselves, so this one looks like it's just trying to fool users.
Any way you slice it, it's very suspicious and is worth a review. I'm having Claude dig into the binary to see what it can find.
Regards, Jared
It has already been dealt with:
https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/t...
Il 01/08/26 17:31, Amal krishna ha scritto:
Hi team, Does the list also include malware?
Brave origin Nightly bin Because i use Brave origin Nightly bin
On Sat, Aug 1, 2026 at 1:47 AM Mark Wagie <mark.wagie@proton.me <mailto:mark.wagie@proton.me>> wrote:
On Friday, July 31st, 2026 at 10:07 AM, Jared Sutton <jpsutton@gmail.com <mailto:jpsutton@gmail.com>> wrote:
Good day everyone,
I was getting a new laptop setup and found this package published just today to AUR:
https://aur.archlinux.org/packages/brave-origin <https:// aur.archlinux.org/packages/brave-origin>
It includes an ELF binary called "translator" in the sources, though it's unclear if it has an execution path currently enabled. I believe the brave-origin-bin package to be published by brave themselves, so this one looks like it's just trying to fool users.
Any way you slice it, it's very suspicious and is worth a review. I'm having Claude dig into the binary to see what it can find.
Regards, Jared
It has already been dealt with:
https://lists.archlinux.org/archives/list/aur- requests@lists.archlinux.org/thread/ ZZPFFWLXLZHSDG2JS5AWDG6QEPFYKDND/#ZZPFFWLXLZHSDG2JS5AWDG6QEPFYKDND <https://lists.archlinux.org/archives/list/aur- requests@lists.archlinux.org/thread/ ZZPFFWLXLZHSDG2JS5AWDG6QEPFYKDND/#ZZPFFWLXLZHSDG2JS5AWDG6QEPFYKDND>
Hi, brave-origin-nightly-bin is maintained by Brave pre-release team
On Sat, Aug 1, 2026 at 12:57 PM Amal krishna <amalrockz669@gmail.com> wrote:
Hi team, Does the list also include malware?
Brave origin Nightly bin Because i use Brave origin Nightly bin
No, those are also maintained by Brave's prerelease account [1] Similarly to their stable releases[2[.. [1]https://aur.archlinux.org/packages?K=brave-prerelease&SeB=m [2]https://aur.archlinux.org/packages?K=brave&SeB=m
On Sat, Aug 1, 2026 at 1:47 AM Mark Wagie <mark.wagie@proton.me> wrote:
On Friday, July 31st, 2026 at 10:07 AM, Jared Sutton <jpsutton@gmail.com> wrote:
Good day everyone,
I was getting a new laptop setup and found this package published just today to AUR:
https://aur.archlinux.org/packages/brave-origin
It includes an ELF binary called "translator" in the sources, though it's unclear if it has an execution path currently enabled. I believe the brave-origin-bin package to be published by brave themselves, so this one looks like it's just trying to fool users.
Any way you slice it, it's very suspicious and is worth a review. I'm having Claude dig into the binary to see what it can find.
Regards, Jared
It has already been dealt with:
https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/t...
Ty, for the info. i was scared for a second. On Sat, Aug 1, 2026 at 10:36 PM Taylor Lookabaugh < jesus.christ.i.love@gmail.com> wrote:
On Sat, Aug 1, 2026 at 12:57 PM Amal krishna <amalrockz669@gmail.com> wrote:
Hi team, Does the list also include malware?
Brave origin Nightly bin Because i use Brave origin Nightly bin
No, those are also maintained by Brave's prerelease account [1] Similarly to their stable releases[2[..
[1]https://aur.archlinux.org/packages?K=brave-prerelease&SeB=m [2]https://aur.archlinux.org/packages?K=brave&SeB=m
On Sat, Aug 1, 2026 at 1:47 AM Mark Wagie <mark.wagie@proton.me> wrote:
On Friday, July 31st, 2026 at 10:07 AM, Jared Sutton <jpsutton@gmail.com> wrote:
Good day everyone,
I was getting a new laptop setup and found this package published just today to AUR:
https://aur.archlinux.org/packages/brave-origin
It includes an ELF binary called "translator" in the sources, though it's unclear if it has an execution path currently enabled. I believe the brave-origin-bin package to be published by brave themselves, so this one looks like it's just trying to fool users.
Any way you slice it, it's very suspicious and is worth a review. I'm having Claude dig into the binary to see what it can find.
Regards, Jared
It has already been dealt with:
https://lists.archlinux.org/archives/list/aur-requests@lists.archlinux.org/t...
On 7/31/26 5:31 PM, Jared Sutton wrote:
Good day everyone,
I was getting a new laptop setup and found this package published just today to AUR:
https://aur.archlinux.org/packages/brave-origin <https:// aur.archlinux.org/packages/brave-origin>
It includes an ELF binary called "translator" in the sources, though it's unclear if it has an execution path currently enabled. I believe the brave-origin-bin package to be published by brave themselves, so this one looks like it's just trying to fool users.
Any way you slice it, it's very suspicious and is worth a review. I'm having Claude dig into the binary to see what it can find.
Regards, Jared
Hi, Thanks for the report, the package has been removed. -- Regards, Robin Candau / Antiz
participants (6)
-
Amal krishna
-
Fabio Loli
-
Jared Sutton
-
Mark Wagie
-
Robin Candau
-
Taylor Lookabaugh