GCVE-110-AUR-2026-000680

The Arch User Repository (AUR) package `htbrowser-bin` was identified as malicious during the June 2026 AUR supply-chain compromise, in which an attacker pushed backdoored PKGBUILDs to roughly 1,900 packages. Building or installing the affected package executed attacker-controlled code. The malicious revision has since been removed from the AUR. Upstream package description: "红莲花国密浏览器是政企专用浏览器，支持国产密码算法，全面适配信创环境，可以提供国产密码改造服务，既满足安全可靠又保障自主可控的浏览器使用需求。".