Is winepak.org compromised?

[DZPM]

The current site looks suspicious. Is there something wrong?

According to the wayback machine, something changed between 2022 and 2023;
https://web.archive.org/web/20230601000000*/winepak.org

There are tons of tutorials asking people to blindly copy-paste a bash command that downloads and install binaries from the winepack.org domain.
If I'm right, this is very concerning, as the attacker could host malicious software there, and easily compromise the machines of your users...

From the security point of view, maybe there should be a warning message on https://winepak.github.io, an announcement, even contacting sites who still have the old copy-and-paste code.

Could someone clarify?

[RokeJulianLockhart]

#27 (comment)

@DZPM, https://web.archive.org/web/20231010135428/https://www.winepak.org/ definitely looks compromised to me. https://web.archive.org/web/20220317110404/http://www.winepak.org/ was how I expect such a website to be. Should one of us https://support.github.com/contact?tags=dotcom-footer%2Crr-general-technical?

[DZPM]

@RokeJulianLockhart I understand the problem is in the domain: maybe a scammer got it after it expired? There were TLS issues in the past, according to older tickets.

In that case, github can't do anything.

I assume the right version should be exactly like https://winepak.github.io

[sysfu]

looks like the domain got hijacked and as a result the hostname in this command does not resolve correctly. Does anyone have a workaround?

flatpak remote-add --if-not-exists winepak https://dl.winepak.org/repo/winepak.flatpakrepo

[RokeJulianLockhart]

#27 (comment)

@sysfu, if flatpak supports IP (v4/6) rather than solely DNS, you could try looking at an old version of the DNS records for that domain, if any still exist. Maybe trying an IP directly shall work.

[boredsquirrel]

please dont attempt to use this repo in any way, it is unmaintained and will not have much worth apart from installing EOL stuff on your systems. I tried to report this repo as "not listed" as the link that it links to is compromised. Dont know if Githubs captcha stuff allowed that...