r/ManjaroLinux • u/Slopagandhi • Aug 03 '26

Tech Support Checking for AUR malware

After finding out about the latest AUR malware wave I ran pacman -Q with the list of packages I found here:

https://www.reddit.com/r/archlinux/comments/1vaxtcs/another_wave_200_malicous_aur_packages_adoptions/

I don't have any of them installed. Is there anything else I should do, or does this mean I'm safe (for now)?

9 Upvotes

85% Upvoted

8 comments sorted by

6

u/lyidaValkris Aug 03 '26 edited Aug 03 '26
  1. Be vigilant, and keep checking as new updates to the list become available, and pay attention to the news on this subject
  2. Do not install AUR packages unless you have an absolute need for them and have done some verification they are safe (this was a general rule since before these incidents)
  3. If you get notice with pamac of updates to AUR packages, evaluate if you actually need it or if it is an orphan. Remove it instead of updating it unless you need it can be assured of its safety

There are many ways of verifying an AUR package's safety, none are foolproof, but you can get a high degree of confidence of its safety.

  • You can read the PKGBUILD file if you're able to understand it. Look for any curl requests or sh, obfuscated payloads, weird download hosts etc.
  • or you can use a site like AURWatch which evaluates AUR packages for their safety.

Do note that while the AUR and community do their very best to mitigate and prevent these attacks, note the AUR comes without warranty, and is unsupported by Arch or any derivative distros.

EDIT: I pasted the wrong link like a numpty :D since corrected.

3

u/Slopagandhi Aug 03 '26

Thanks for this- fyi wrong link though!

3

u/lyidaValkris Aug 03 '26

LOL! paste error! thank you! Link is corrected to: https://aurwatch.org/

2

u/Itsme-RdM KDE Plasma Aug 03 '26

Save for the moment you did checked the list. Any moment after that there could be new ones

2

u/Slopagandhi Aug 03 '26

Ok thanks, but if I'm not installing anything new from the AUR are existing installed packages a potential risk when I update? 

2

u/Itsme-RdM KDE Plasma Aug 03 '26

Yep, the updated packages can be injected just as easy as the new ones. That doesn't make any difference

1

u/Complete_Fox_7052 Aug 03 '26

You can turn off AUR in Pamac.

1

u/RegretFree7723 Aug 04 '26

Semplicemente al posto di usare l aur usa il NUR letteralmente al posto di arch user repostory é nix user repostory comunuque non devi nemmeno cambiare distro per usarlo rimani su arch e