It has been brought to the attention of the KDE security team that NeoNova Animated Wallpaper (https://github.com/abbygraceton1992/NeoNova-KDE-Wallpaper) is shipping malware.

This report came from Serg Star who spotted it reviewing this code. It's great that we have people spotting this stuff, though it may be too late for some.

The Malware

The package looks very legit, its an animating wallpaper that works as advertised, they even did later commits on top adding configuration options!

However since the initial commit the code has been shipping hidden malware.

A script (hidden in a base64 string in a base64 string) makes a web request to download an "image", which is another bash script which in turn downloads a libary .so file into ".config/Plasma6Library.so" and launches it via LD_PRELOAD=~/.config/Plasma6Library.so sleep 999999
The payload thus far looks like this: https://github.com/BishopFox/sliver which is designed to allow remote control.

If you have installed this wallpaper, a good test would be checking for .config/Plasma6Library.so and I would suggest starting anew.

What Happens Now

There is only so much we can do with 3rd party content. We have reported it to all relevant places including Pling and OpenDesktop who have taken swift action within hours of us getting the report.

It it a stark reminder to be vigilant and wary when installing external content from other sources especially those that run in unsandboxed contents, and a reminder to those of us working on the Linux desktop to continue working on technologies that allow for safer and better distribution.