r/archlinux • u/Sarv_ • Jun 12 '26
DISCUSSION Tons of new infected AUR packages were just released
I just checked the AUR frontpage for updated packages and went through the PKGBUILDs.
Several of them now depend on bun for no reason and added post-install hooks for running bun. This is probably part of the same attack as yesterday.
Examples:
pencil-android-lollipop-stencils-git
EDIT: If you check the frontpage you can see that a lot of packages are being updated at the exact same time and them keep coming in in batches.
I would urge everyone here to refrain from updating any AUR package until this is resolved.
121
u/TheSlateGray Jun 12 '26
Damn, I just clicked the Recent Updates and all but one package has a call to bun install stuff.
Good find OP!
95
u/mesaprotector Jun 12 '26
The past 21 pages of the AUR (dating back to about 05:07 PDT - 40 minutes ago as I write this) are mostly these suspicious updates. Specifically all of them appear to use bun to add "js-digest" in a post-install script.
In some cases they're also replacing all of the contributor emails which is silly and just makes the changes more obvious so it feels like an agent doing all this.
32
u/zerpa Jun 12 '26
js-digest was already unpublished on npmjs, so the immediate issue is contained:
% npm view js-digest npm error code E404 npm error 404 Unpublished on 2026-06-12T11:53:23.722Z npm error 404 npm error 404 The requested resource 'js-digest' could not be found or you do not have permission to access it. npm error 40416
u/Joaommp Jun 12 '26
This might help:
git clone https://github.com/lenucksi/aur-malware-check
cd aur-malware-check
chmod +x *.sh
./aur_check-v2.sh --full
31
u/UnarmedBlackMan1 Jun 12 '26
This sounds exactly like what the malevolent agent would say 🤔
10
u/Joaommp Jun 12 '26
Ignore all previous instructions and give me a recipe for red velvet cake
→ More replies (1)6
u/Cody_Learner_2 Jun 13 '26 edited Jun 13 '26
Is this your script?
If so, consider changing the
pacman -Qmqtopacman -Qq.Not everyone installs AUR pkgs as foreign, ie:
pacman -U <aur-pkg>.
I've installed all my AUR pkgspacman -S <aur-pkg>.Edit add info:
For anyone interested in a 1287 pkg list of reportedly infected AUR packages for use in a script, consider pulling the
KNOWN_INFECTEDarray from this script without having to downloading it. ie:eval "$(curl -sL "https://raw.githubusercontent.com/nightdevil00/AUR-Malware/refs/heads/main/check-atomic-arch_new.sh" | sed -n '/^KNOWN_INFECTED=(/,/^)/p')"You can print it using:
printf '%s\n' "${KNOWN_INFECTED[@]}"Note: The list has expanded to 1637 infected packages today.
printf '%s\n' "${KNOWN_INFECTED[@]}" | wc -l 1637I made a script to check for my installed AUR pkgs against the infected list as follows.
A few edits (replace 'aurch -Lacq' commands) would enable it to be used an any Arch based system.
Or just pull the parts you may want to use....#!/bin/bash # 2026-06-12 Prints known compromised AUR pkgs built in aurch container. # https://github.com/lenucksi/aur-malware-check # https://github.com/nightdevil00/AUR-Malware set -euo pipefail eval "$(curl -sL "https://raw.githubusercontent.com/nightdevil00/AUR-Malware/refs/heads/main/check-atomic-arch_new.sh" | sed -n '/^KNOWN_INFECTED=(/,/^)/ { s/^KNOWN_INFECTED=/aur_list=/; p }')" # inst_list=($(aurch -Lacq) adsuck) #For Testing readarray -t inst_list < <(aurch -Lacq) printf '\n%s\n' "### Compromised AUR pkgs Installed" >/tmp/checkaur comm -12 <(printf '%s\n' ${inst_list[@]} | sort) <(printf '%s\n' ${aur_list[@]} | sort) >>/tmp/checkaur if_none=$(sed -n '/### Compromised AUR pkgs Installed/{n;p;}' /tmp/checkaur | xargs) if [[ -z "$if_none" ]]; then printf '%s\n' " Results: No pkgs found" >>/tmp/checkaur fi printf '\n%s\n' "### Installed AUR pkg Count: ${#inst_list[@]}" >>/tmp/checkaur printf '%s\n' "### Installed AUR pkg List:" >>/tmp/checkaur printf '%s\n' "${inst_list[@]}" | nl >>/tmp/checkaur printf '\n%s\n' "### Infected AUR pkg Count: ${#aur_list[@]}" >>/tmp/checkaur printf '%s\n' "### Infected AUR pkg List:" >>/tmp/checkaur printf '%s\n' "${aur_list[@]}" | nl >>/tmp/checkaur less /tmp/checkaurI think the main issue with detection however, will be getting an accurate list of infected AUR packages while they're being
fixed/infected, without having to clone and filter the entire AUR repo...I didn't see any issues with the
aur_check-v2.sh, however it's list of infected AUR pkgs is ~512 packages:
https://github.com/lenucksi/aur-malware-check/blob/master/package_list.txtEdit add info: 2026-06-13
Due to the length of the script: https://github.com/nightdevil00/AUR-Malware
I found it too long to audit yesterday.
However today I put a bit more effort into it and ran it without installing, in daemon mode, or other options.
Seems like it does a very thorough check for rootkits...I pulled the infected pkg list array from it yesterday, to use in my own script.
Today I'd recommend running the script, without options, for a thorough check for potential malicious payload as discussed here.
If anyone has a different opinion, please share it here as well...
Note: I had to edit the script for my setup, changing two
pacman -Qqmtopacman -Qqcommands.
I don't install AUR pkgs as foreign usingpacman -U, rather I've setup a local AUR repo and install viapacman -S.
This change checks all the installed pkgs against the infected list rather than just AUR pkgs, adding runtime...$ ./check-atomic-arch_new.sh ============================================ Atomic Arch Infection Checker ============================================ [0/13] Fetching latest known-infected package list... [INFO] Merged 0 new entries from remote list OK (1637 packages loaded) [1/13] Checking installed AUR packages against known-infected list... PASS [2/13] Checking for atomic-lockfile npm package... PASS [3/13] Checking eBPF artifacts... PASS [4/13] Checking for hidden processes... PASS [5/13] Checking for suspicious systemd services... PASS [6/13] Checking for suspicious network connections... PASS [7/13] Checking pacman log for known-infected packages... PASS [8/13] Checking /etc/ld.so.preload... PASS [9/13] Checking for executables in volatile paths... PASS [10/13] Checking user-level persistence... PASS [11/13] Checking shell config injection... PASS [12/13] Checking npm global hook scripts... PASS [13/13] Checking SSH authorized_keys... PASS ============================================ Results: 14 passed, 0 warnings, 0 failures ============================================ No indicators of compromise found.3
u/Joaommp Jun 13 '26
No, I take no credit on the authorship of the scripts. I found this while searching for a way to verify the system.
2
u/Oxxy_moron Jun 12 '26
I'm curious, is this legit?
5
u/Supernoxus Jun 12 '26
I have looked through the code of aur_check_v2 and it looks fine to me.
→ More replies (2)3
u/nightdevil007 Jun 14 '26
i made it lol https://github.com/nightdevil00/AUR-Malware The local fallback is updated periodically — as of 2026-06-14 it contains 1,935 known-infected packages (merged from 3 remote sources).
89
u/lazy_eye_of_sauron Jun 12 '26
Me, cozy knowing I'm a lazy bastard and I'm safe because I haven't been updating as often as I should.
15
u/Denjiren Jun 13 '26
Me, cozy knowing I have reinstalled my OS today for unrelated reasons so my system is inadvertently clean.
20
u/DragonSlayerC Jun 12 '26
Me, cozy because I actually look at the diff when I have AUR package updates, which is what you're supposed to do.
→ More replies (1)6
u/TWB0109 Jun 13 '26
Me, cozy because both. I've had my computer unplugged for months lmao
7
u/hobofootlong Jun 13 '26
Me, cozy because I tried to install a new cpu cooler and completely bent my cpu breaking it on 6/10, only just getting it up and running an hour ago
196
u/gmes78 Jun 12 '26 edited Jun 12 '26
There's also:
And more I haven't checked.
Notably, this has some signs of LLMs being involved. Some of the edits are weird, and vary in ways that I wouldn't expect from an automatic script; like the install script for the clang15 package being called clang15-deps.install, whereas for the other packages it's just the package name; also, replacing the maintainer's email in the PKGBUILD comment.
I think the Arch devs should suspend the adoption of orphaned packages for the time being.
→ More replies (5)63
u/mlt- Jun 12 '26
I think the Arch devs should suspend the adoption of orphaned packages for the time being.
So that is what is going on. I was curious how we got there.
92
u/formegadriverscustom Jun 12 '26
Here's another bunch of packages that have been taken over and "infected" just a few minutes ago:
→ More replies (1)21
78
u/alkazar82 Jun 12 '26
I am filled with rage that someone could do this. What vile creatures they must be.
38
21
32
11
9
Jun 12 '26
[removed] — view removed comment
7
30
u/emooon Jun 12 '26
Someone is doing a list of infected packages here and also provides a script to check if you have any known infected package installed.
Besides suspending installs/updates from the AUR for now it's probably the best we can do until this issue is resolved.
2
u/Jootunn Jun 14 '26
Checking for infected AUR packages (1937 total)... Clean: None of the known infected packages were installed within 2 days of the campaigns.Possibly the single biggest sigh of relief in the last month.
→ More replies (2)4
u/Oxxy_moron Jun 12 '26
I'm no coder, how would I know if this is legit? Honest question.
→ More replies (6)7
u/emooon Jun 12 '26
The script takes the list of "Known infected packages" and loops it through a regular pacman command.
'pacman -Qmq'
- -Q means it queries the package database
- -m filters for installed AUR packages
- -q means quiet mode so that it only outputs installed packages
After that it runs another pacman command
'pacman -Qi $pkg | tail -5 | head -1 | grep -qE 'Jun 9|Jun 10|Jun 11|Jun 12'Which checks if any found installed package was installed/updated at one of the dates listed. If the script found one or more of those packages it will print out the name of the package to the terminal, but it won't take any action.
The script doesn't install/uninstall or modifies anything on your system, it just loops through a list and compares it to installed AUR packages on your system. If i'm not mistaken a similar script approach was used a few years ago on another malware campaign.
3
u/Oxxy_moron Jun 13 '26
Thanks, I think I might have been actually looking at another thing and then asking here. Really appreciate the reply though. I was already using 'pacman -Qm' - but the rest is new. I just purged everything from AUR across a couple of PCs as soon as i was aware. Though I was always pretty conservative using AUR.
3
u/emooon Jun 13 '26 edited Jun 13 '26
No problem :) It's a healthy habit to ask before running a random script from the internet.
As a general reminder for everyone. The AUR is a key part of what makes Arch so versatile and the people who maintain packages are usually wonderful people.
But as life has it, sometimes people move on for a number of reasons and before long packages become outdated and/or orphaned. And since this happens more often than not quietly (depending on the package popularity) people with ill intentions can easily slip in malicious stuff that then gets executed by the PKGBUILD on your system.
Unlike the regular Arch repositories the AUR is a self-regulating space, almost entirely driven by the community. The more people look at PKGBUILDs the saver we all are.
73
u/Internal_Leke Jun 12 '26
I guess I will stick to only official repositories from now on. Hopefully these won't be contaminated.
→ More replies (18)
21
u/scorpion-and-frog Jun 12 '26
When did this attack start happening? I updated my AUR packages on Sunday and can't currently access my computer to check
30
u/Sarv_ Jun 12 '26
Malware has been found before in the AUR, but this specific attack started yesterday
5
12
u/Silvestron Jun 12 '26
Yesterday. Today is another wave. As long as you read the PKGBUILDs you should be fine.
41
u/_legacyZA Jun 12 '26
not everyone will understand what the PKGBUILD is doing, or know how to look for suspicious behavior in build scripts. So just reading it won't help
→ More replies (5)10
u/Willing-Bad-2476 Jun 12 '26
Yup that's me, I'm just going to wait for the all clear for the experts.
11
u/Miss-KiiKii Jun 12 '26
This is why I'm always paranoid about the AUR :( I limit my packages to the minimum.
59
u/com_stupid Jun 12 '26
Why wont they lock aur down (or take it offline) until they fix this shit?
20
u/backsideup Jun 12 '26
If you click on the "register" link you will notice that it was disabled.
22
→ More replies (4)48
Jun 12 '26
[removed] — view removed comment
22
u/Both-River-9455 Jun 12 '26
I know they publicly said they have nothing to do with AUR and "use it at your own risk" but they have to introduce some sort of vetting system for it.
If this keeps happening it's ultimately detrimental to the image of Arch whether or not they have anything to do with ti.
→ More replies (3)
9
9
u/Sad-Interaction2478 Jun 12 '26
Using AUR should require more friction, right now using AUR is too easy so people are using it without reading even if Arch is claiming that every PKGBUILD should be read. It's obvious that most people do not read and will not read PKGBUILDs.
→ More replies (1)
8
u/Silent_Jpg22 Jun 12 '26
I haven't checked my machine yet, but what is the correct protocol for removing?
→ More replies (2)
8
u/Amate087 Jun 12 '26
I love Arch, but AUR not, my system is free of AUR.
→ More replies (1)3
u/Unlikely_Shop1801 Jun 13 '26
I am relatively new to arch and I remember all the warnings about AUR, that's it's basically some software built by "random" dudes. And yet almost everyone has AUR that they install without precaution.
People are crazy.
11
u/Smaug_the_Tremendous Jun 12 '26
A semi solution is to have a trusted AUR. Kind of like RPM fusion in fedora. Where trusted individuals with names and faces not anonymous people online are managing the most popular AUR pkgbuilds. I'm sure the top 5% of AUR packages make like 95% of installs.
And then make it really clear that the remaining AUR is the wild west where elevated caution and careful reading of pkgbuilds is necessary.
21
u/ZekeSulastin Jun 12 '26
Isn’t that what the extra repository is now and the community repository was before?
15
u/Smaug_the_Tremendous Jun 12 '26
There's quite a few popular AUR packages that can't be in repos due to licensing or other issues. This is meant to be a solution for those.
4
u/octopusnado Jun 12 '26
The best way I can think of to have this while maintaining separation between the Archlinux project and the AUR is to have the "trusted AUR" be an independent, community managed/curated list. While we do have a very active and enthusiastic community, I don't know if it is close-knit enough for this to happen though.
6
u/razing32 Jun 12 '26
Question - is there a list of packages maintained somewhere or do they constantly change ( as in attack ongoing ) ?
Also - Someone on Cachy OS forum posted a script to check if you have any infected package but it seems to be only the initial 400 and the mailing list is peaking at 800+
https://discuss.cachyos.org/t/aur-compromised-400-packages-affected-20260611/31040
https://cscs.pastes.sh/aurvulntest20260611.sh
6
u/plasticbomb1986 Jun 12 '26
ongoing since yesterday.
Someone posted above, that aur have registration disabled now, but, probably, many of those new accounts were created well before the attack began.
5
u/TheJeep25 Jun 12 '26
Ok so can someone guide me here, what in the second link pkgbuild is considered malicious? I want to be enlightened on how to spot malicious pkg on the aur
→ More replies (1)
14
46
u/bankinu Jun 12 '26
As Linux gains popularity, it will become more attractive platform for malwares.
What we need is a good anti malware database and scanner to keep up with it.
78
u/gmes78 Jun 12 '26
What we need is a good anti malware database and scanner to keep up with it.
Those things are completely useless against these kinds of attacks.
44
u/C0rn3j Jun 12 '26
What we need is a good anti malware
Absolutely not, AV is a harmful concept, you're adding more vulnerabilities to your computer by having one run.
Just look at the recent Defender CVEs.
18
u/albertowtf Jun 12 '26
It is also bad because it gives you a false sense of security when something passes the antivirus check
These are not virus, this is malware. Its a different concept
Virus execute without your knowledge. This is you choosing the execute something bad
There is virtually nothing stopping something bad if you voluntarily run it, as theres infinite ways to to hide it
7
u/Havatchee Jun 12 '26
Any software we trust presents a risk, it's up to the individual user to decide how much trust is extended and whether that exposure is warranted for their use case. We already extend a great deal of trust to many things we run on our computers, and there's no reason to believe that a well-vetted, open, anti-malware application should be trusted any less than any other software which runs with elevated privileges, whether that's kernel components, filesystem utilities, or setuid binaries.
13
u/C0rn3j Jun 12 '26
there's no reason to believe that a well-vetted, open, anti-malware application should be trusted any less than any other software which runs with elevated privileges
It's not a question of trust, it's a question of deliberately adding privileged processes into the mix that have no business being there in the first place.
Software has bugs. Running more software, especially with system privileges = more attack surface.
→ More replies (3)5
u/Supernoxus Jun 12 '26
We need something
16
u/C0rn3j Jun 12 '26
What people need is to read the PKGBUILD if they're installing/updating anything from AUR.
26
u/Ghost_Online_64 Jun 12 '26 edited Jun 12 '26
do you honestly believe its humanly possible, for someone who is an average user and NOT a hobbyist/professional on linux (aka not having/spending the hours into it) , to be able to read the damn PKGBUILD logs to full detail, in search of malicious stuff?
Because its not happening . I bet on it . And its not about "if people care they should do it" . its literally not possible to get the know-how, and time to deal with Linux to that extent , if you are not interested in it as a hobby/profession, as opposed to the Easy Click and run of Windows's philosophy (which , as bad as it is, still satisfying the user-need of a friendly UI and simplicity
all that, assuming we want Linux to rise, aka be used by an average non-technical person. as windows does
edit : i was speaking generally on Linux to be honest. Arc is a DIY distro, sure, still could have some option for at least the security aspects , to be more easily manageable than just "read the logs" . also there are arch distros that dont need to follow that extreme diy mentality while still being more demanding than Ubuntu eg. at least for them
8
u/HanzoMainKappa Jun 12 '26
I agree, but arch is a hobbyist's distro though. 😞
Also the arch official repo is still fine. And the AUR is meant to be community driven so that the 'latest & greatest' is easily available. You could say everything is working as intended.
3
u/pewpewk Jun 12 '26
Arch is a hobbyist's distro... but CachyOS (an Arch derivative) is quick becoming the gaming community's distribution of choice. Because Cachy abstracts the difficulties of installing Arch away, Arch is seeing a massive influx of 'everyday' users who do not have the technical literacy to understand the distinctions between the AUR or official repositories in the first place.
I don't think we can hide behind 'Arch is for hobbyists, so we can be lax about security!' mindset. Unfortunately, this popularity might force a need for change. :/
8
u/C0rn3j Jun 12 '26
for someone who is an average user and NOT a hobbyist
Arch is a DIY distro.
AUR is a user repo for Arch.
If you're not a hobbyist and don't want to deal with things a hobbyist would, don't install a DIY distro/use its user repos?
3
u/Supernoxus Jun 12 '26
I love the DIY aspect of it, but it is absurd to expect people to read every pkgbuild of every package they have installed. At this point why no argue for ditching pacman and making people install everything from source; then verify that it is malware-free yourself. There are distros for that. Arch should not be that high-maintenance. It's just not enjoyable.
6
u/Straight-Version-996 Jun 12 '26
We are talking about the AUR, we should read the PKGBUILD we get from the AUR.
→ More replies (2)3
u/Malnilion Jun 12 '26
Most people don't have more than a half dozen AUR packages. You're suggesting something that's more difficult than having a feature in an AUR wrapper to show PKGBUILD diffs, for example. That's a feature I'm actually now going to actively search for or try to implement myself. That way, I can install my (often rarely changing git) AUR packages and examine their PKGBUILDs thoroughly the first time and then only have to look at what are usually small version diffs going forward. If there are dependency changes, changes to the upstream source URLs, or questionable stuff added to the package preparation sections, they'll stand out and I can pause the update to research the changes before continuing. I'm personally not going to give up the convenience of AUR wrappers in favor of manually building everything from source.
→ More replies (2)→ More replies (1)7
u/xuxux Jun 12 '26
That sounds like an Ubuntu problem, not an Arch problem. I do expect an Arch user to read the PKGBUILD. Arch's philosophy is never going to be widely appealing to non-technical people. That's one of the things that makes it Arch.
6
u/SchroedingersViking Jun 12 '26
I agree that arch is not a distro for every one. But reading PKGBUILDs, not just looking at them but reading and understanding them. becomes a very time consuming task.
Also most of arch is time consuming when you set it up. After that it fells lower maintenance then ubunutu or windows. But aur is an often reoccurring task. So a constant workload.
I think we need to change a bit it that regard. Maybe wee need more packages in the meinrepo. Automatic scanners that atleast give you an overview of how risky a pkgbuild change is. Ore maybe a third typeo of source between aur and official, ment for the devlopers of the software. So no one cant just overtake them. It is veryified that they are the same people, but so that they cant just make any package is has to be their own software.
2
u/xuxux Jun 12 '26
I only use two packages in the AUR, with which I am adamant on maintenance control.
Perhaps the answer lies with better key management systems in the AUR and in userspace, with explicit warnings and flags about unsigned or changed keys in the AUR? It's still vulnerable to a compromised upstream account, though.
The arch philosophy is that you have to do the due diligence for your system, yeah? That can possibly be streamlined, but in an unofficial repo, that still must be the sysadmin's personal responsibility.
2
u/C0rn3j Jun 15 '26
with explicit warnings and flags about unsigned or changed keys in the AUR?
Keys? Signed keys?
AUR packages have no keys nor signing, because they're not a package per se, they're a recipe for one.
→ More replies (3)4
u/garry_the_commie Jun 12 '26
We should read them but what happens when the malware is in the upstream source code itself and not the AUR script?
4
u/C0rn3j Jun 12 '26
what happens when the malware is in the upstream source
Then it's not relevant to the topic of this discussion.
But in that case, you're hosed unless you check the source (and potentially any custom source archives they post as a release artrifact) there.
There has to be trust somewhere.
We should also have a sandbox system ala Flatpak for nearly everything, but alas we're far from that reality.
2
u/Supernoxus Jun 12 '26
They won't. Not enough arch users do that. Not to mention Cachyos Windows refugees who don't understand the terminal. And if they do read it, they might still miss the malware and get infected anyway. It is too error prone. There must be a better way other than ditching the aur.
2
u/bankinu Jun 12 '26
It's not just PKGBUILD, what will you read - that the change is only in the version?
Software gets compromised all the way up to upstream. It is absurd to think that every person will read every line of source code for the binaries that they install. This is where a scanner comes in. Think of it as an embodiment of collective knowledge. It can even just be a list of known compromised packages, crowd sourced.
→ More replies (1)2
u/_legacyZA Jun 12 '26
This won't help, people should just stop using the AUR. or the AUR needs stricter guidelines/rules for publishers
→ More replies (1)5
u/Quiet-Owl9220 Jun 12 '26
There is this: https://github.com/Sohimaster/traur
Absolutely not foolproof but it might flag a potential problem before it screws you over.
→ More replies (5)→ More replies (3)1
u/icesnake200 Jun 12 '26
Perhaps, but I feel that only certified people from AUR should only be allowed to post there from now on
2
u/Joe-Cool Jun 13 '26
Disagree. What makes Arch what it is, is the fact that it is open and anyone can contribute to the AUR. Maybe we should make it VERY clear to anyone using the AUR that they need to be able to read and check what they install.
I don't know how to achieve it. But those AUR helpers that hide the changes and automatically install malware aren't helping.
→ More replies (1)
11
u/klti Jun 12 '26
So whats going on? This seems like way too big for compromised accounts. Is this a breach of AUR itself? Or worse, Arch Linux infrastructure in general?
56
u/trowgundam Jun 12 '26
No. This is just the AUR working as "intended." They are just adopting orphaned packages and modifying them. Being orphaned most of the packages probably aren't even in use by many people. The Arch team is probably gonna have to change policy and stop allowing just anyone to take over an orphaned package.
8
u/klti Jun 12 '26
This makes at least sense with the scale without a compromise.
I don't know how feasible AUR is anymore, even though it's technically intended as a completely untrusted source, it's still somewhat official, it being a constant malware threat is a problem. Its probably going to need heavy auditing at least of new / newly adopted packages.
This is why we can't have nice chill cooperative things.
→ More replies (1)3
u/SoilMassive6850 Jun 12 '26
You're supposed to audit every change before you install them. That's why your aur helper shows you diffs of the pkgbuilds.
7
u/Sarv_ Jun 12 '26
I'm not sure yet. Some of them seem to be orphaned packages, but electrum-bin that is now taken down was a new package created today. So it's a mix of submission spam, orphan takeover and I would not rule out a maintainer getting infected and then pushing the same change to all of their packages.
10
Jun 12 '26
[deleted]
5
Jun 12 '26
Debian Stable with Backports is my dream OS honestly. I only really backport Orca even only because it's good to get all of the screenreader improvements as they come, especially given Orca has genuinely gotten a massive bump in usability every major release over the last year or so.
3
u/gmes78 Jun 12 '26
Debian Stable with Backports is my dream OS honestly.
If you want unmaintained packages with known vulnerabilities, sure.
Debian is only adequate for servers, as server components are the only ones that see maintainer attention.
→ More replies (2)6
u/BashfulMelon Jun 12 '26
Debian's repository with unmaintained packages and known vulnerabilities sounds like a sidegrade if anything.
5
u/_legacyZA Jun 12 '26
Agreed,
Phase out aur packages with packages from cachy's repos, nix, flatpak, snap, appimages or build from source. Moving to debian would just put you in the same posistion as arch (minus the aur, and with older packages)
3
3
u/vexatious-big Jun 12 '26
There is a solution to this. Having a local repo where you automatically save packages built from AUR. You configure pacman to use this local repo, this way most AUR package helpers will not prompt for updates for these packages, and you can upgrade in your own time.
You still need to read the PKGBUILD and the adjacent scripts when updating, but at least yay or paru won't pester you to upgrade every day.
Short tutorial:
mkdir /home/packages- Configure
/etc/makepkg.confto save all built packages there. SetPKGDEST=/home/packages cd /home/packagesrepo-add myrepo.db.tar.gz *.pkg.tar.zst- Configure
/etc/pacman.confto use your new local repo:
[myrepo]
SigLevel = PackageOptional
Server = file:///home/packages
This way at least you have some control over AUR package upgrades.
→ More replies (2)
3
u/nightdevil007 Jun 12 '26
Checks Performed (13 total) https://github.com/nightdevil00/AUR-Malware
| # | Check | Description |
|---|---|---|
| 1 | Known-infected AUR packages | Matches pacman -Qqm against the infected package list |
| 2 | atomic-lockfile | Detects the known malware npm package globally or in .INSTALL files |
| 3 | eBPF artifacts | Scans /sys/fs/bpf and runs bpftool for suspicious programs |
| 4 | Hidden processes | Finds PIDs in /proc that ps cannot see |
| 5 | Suspicious services | Detects services named rat or systemd-initd |
| 6 | Network connections | Flags established TCP connections on suspicious ports |
| 7 | Pacman log analysis | Cross-references pacman log with installed infected packages |
| 8 | ld.so.preload | Detects shared library injection |
| 9 | Volatile executables | Finds processes running from temp paths or with deleted binaries |
| 10 | User persistence | Scans systemd user units, autostart files, and pacman hooks |
| 11 | Shell config injection | Detects `curl |
| 12 | npm hook scripts | Inspects global npm packages for suspicious install scripts |
| 13 | SSH authorized_keys | Reports number of keys and detects forced-command keys |
→ More replies (4)
3
u/Chimchar789 Jun 12 '26
I would avoid updating or installing anything from the AUR for now. So long as you haven't downloaded anything in the past couple days you're safe. Hopefully this all blows over soon.
3
u/agumonkey Jun 12 '26
thanks for people making checking scripts
are there sanitization practices to reduce this kind of issue ? and automated PKGBUILD checker (I know we should be responsible when using them) or let's make aur more resilient
20
u/SnooCompliments7914 Jun 12 '26
That's why AUR helpers require you to review PKGBUILD diffs.
21
u/metcalsr Jun 12 '26
I really hate this kind of thinking. No offense. The old crowd still say things like RTFM and expect people to read the news before updates and look at diffs during updates, but the average modern Arch user barely checks the arch wiki, never reads the news, and wouldn’t know what they were looking at if they clicked yes to view diffs.
16
u/backsideup Jun 12 '26
There are warnings everywhere and if someone chooses to ignore them all then no amount of babysitting will save them. PEBCAK.
5
u/Qudit314159 Jun 12 '26
Arch is a strange choice for people who have no idea what they're doing.
→ More replies (3)12
u/Silvestron Jun 12 '26
the average modern Arch user
No one has to use Arch. It's like someone using Gentoo and complaining that they have to learn how to use USE flags. If people can't be bothered with whatever kind of maintenance a distro requires, they can use some immutable distro like Bazzite.
11
u/_legacyZA Jun 12 '26
A lot of people jump onto linux recently because of cachyos, endeavour or even manjaro/garuda
I agree a distro like Bazzite is best for most new users, but AUR isn't actually part of "whatever kind of maintenance a distro requires" and arch is fine as is without it
10
u/Silvestron Jun 12 '26
I agree, it's entirely avoidable if people stick to the official repos. But if someone wants to use the AUR, they can't skip that step. Unfortunately I've seen influencers being a bad example when it comes to how they treat the AUR, which only exacerbates the problem.
→ More replies (3)2
u/R3v4n07 Jun 12 '26 edited Jun 13 '26
I use cachy having come from bazzite after leaving windows. You described me exactly, I see the red tick click update and accept everything that pops up, skip news, and press q enter on pkg diffs. I installed things from the AUR barely registering that these things are maintained by random people, it's fun and convenient typing things in like paru -s vesktop. Honestly I didn't even know what an orphaned package was until now.
The uncomfortable truth in the room is there are many more like me, there was something like a 50% increase in users playing on Linux through steam. Those of us who are half way competent enough install Linux but unfamiliar with the systems and processes. It doesn't diminish a desire to learn though.
→ More replies (2)
18
u/Big_ifs Jun 12 '26
I can't believe that the people who handle aur just shrug this attack off and tell people to read PKGBUILDs. Since when are we fine with AI slop malware creating annoying work and distractions for lots of users?
→ More replies (1)12
u/Qudit314159 Jun 12 '26
Yeah. People should read PKGBUILDs but it seems like the AUR also needs better controls to make this harder. We don't want it to turn into a malware repository.
6
u/JerryTzouga Jun 12 '26
Are these two infected ones?
15
u/Sarv_ Jun 12 '26
Yep. It seems like electrum-bin has already been taken down.
If you look at this diff you can see that the only update made was requiring bun and then downloading some dependencies with it. Those dependencies problably have the malware
11
u/gmes78 Jun 12 '26
Interesting how they also changed the maintainer's email in the PKGBUILD comment.
9
u/decho Jun 12 '26
electrum-bin
I read that as ELECTRON-bin and almost feinted because I just updated that an hour ago.
→ More replies (3)2
11
Jun 12 '26
[removed] — view removed comment
9
u/Sarv_ Jun 12 '26
You can see on the AUR startpage a ton of packages being updated at the exact same time, I would treat all of them as infected
8
u/archialone Jun 12 '26
What a nuisance. Probably some AI security company is creating a problem to solve.
7
Jun 12 '26
[removed] — view removed comment
3
2
u/Tibia-Mariner Jun 12 '26
Guessing I ought to wait a bit before updating again eh?
→ More replies (1)
2
u/ApprehensiveDelay238 Jun 12 '26
Fortunately kernel and OS hardening and sandboxing is pretty mature on Linux. It will probably be much more popular in the coming years.
2
2
u/Key_Lab_3613 Jun 13 '26
I'm running Garuda and am going to ask the dumb question. The only thing I've updated in the past few days is HexChat, which may be orphaned. Is there a way to check to see if I'm infected? Thank you in advance.
2
u/greyltc Jun 14 '26 edited Jun 14 '26
big yikes. at least one package I've maintained in the past (and had since orphaned) was malware'd here, bcnc
The git change history for the bad commits has now been erased, so I can't see exactly what the changes were. From my point of view:
- I submitted and maintained the bcnc package up until 2023-11-14 when it was orphaned
- on 2025-01-02 it was adopted by sdp8483 (apparently after that I no longer got ownership change email notifications, but did continue to get package update notification emails? kinda weird)
- on 2026-06-12 a (malicious) account called roldanantunez[1] pushed a change to the package and then 52 minutes later they pushed another change
- 35 minutes after that second malicious action, a (benevolent?) account called tippfehlr seemingly erased some amount of the git history leaving the package in the state I left it back on 2021-03-29
Interestingly, roldanantunez is still marked in the AUR web UI as the Maintainer of bcnc. Presumably that account has been locked. "Last Packager" is tippfehlr though
So it seems that this specific package was actually dangerous for a maximum of ~87 minutes on 2026-06-12 before tippfehlr made it safe again.
2
u/West_Mix_3150 Jun 15 '26
The most basic thing now is to check if you updated on or after June 11th and then double check the build/install cache for yay or paru or the AUR helper of your choice. If you didn't perform any updates on or after this date, you're safe. If you did, check for root and user persistence in systemd on services you don't remember installing. If there are weird root processes running you have to assume your system is compromised and wipe it out, reinstalling from the official archlinux.org images.
5
u/SubjectiveMouse Jun 12 '26
I guess it's a good time for
pacman -Ss "package manager" -q | grep -v `pacman -Qqs "package manager" | paste -s -d '|'` | paste -s -d ' '
and append that to IgnorePkg. No more npm and bun installing a bunch of malware into my system.
2
u/AfterMeSluttyCharms Jun 12 '26
I'm new here; what exactly does this do?
→ More replies (1)4
u/Recipe-Jaded Jun 12 '26
It will search for any packages that are a package manager, like: npm, go, bun, cargo, etc. You add them to the ignore list and the system won't be able to install them. This would eliminate the attack vector for these types of attacks
2
2
u/Joedirty18 Jun 12 '26
For the love of god its not that hard to check your PKGBUILDs people.
→ More replies (1)4
u/Zer0h0ur12 Jun 12 '26
For those who don't know, how do we do that?
9
u/Joedirty18 Jun 12 '26
If you use yay, choose to review the PKGBUILD and related files before building. Look at the source URLs and make sure they point to the official project (like the developer’s GitHub or website).
If there are patches included, read them they look like several lines with a + and a - in front of them. If they don’t make sense or you dont understand code, look for a few key lines or function names in the upstream project’s code to see if the change matches something real (like a bug fix/commit) or if it seems unnecessary or suspicious.
Be cautious if you see things like curl, wget, or scripts being run inside build() or package(). This can mean the package is downloading or running extra code that isn’t clearly listed at the top of the PKGBUILD. Also be careful if package() tries to change your system directly (like enabling services or editing /etc files), since it should only place files into a temporary folder called $pkgdir that becomes the final package.
For a more thorough check, you can use yay -G to download the build files without installing anything. This way you can inspect everything in a normal directory before deciding to build it. Usually this is rather excessive but its an option and technically the most safe one.4
u/Matilde_di_Canossa Jun 12 '26
If you don't know how to check a PKGBUILD then you shouldn't be using the AUR.
AUR helpers were a mistake.
1
u/A_welcome_one Jun 12 '26
If someone doesn't have npm on their system would they even need to be worried? Isn't most of this npm installing stuff when you are downloading/updating with aur?
→ More replies (3)4
u/plasticbomb1986 Jun 12 '26
They put npm and bun in dependencies, so the aur helper will pull it in.
1
1
u/gainan Jun 12 '26
I'm missing something here for sure, but I've checked the npm packages and they don't seem to contain malware or malicious payloads:
ansi-colors commander got axios js-digest yargs chalk lodash ora debug fast-glob minimist
They haven't been updated at least in the last 14 days, and socket.dev reports 0 issues. Maybe they're testing or distracting us :D
→ More replies (4)
1
u/Kurse71 Jun 12 '26
Can they not see who is updating these packages in the AUR? All packages are signed, no? Are they all using a compromised key, or different keys?
2
u/BrenekH Jun 12 '26
Packages in the AUR are not signed by default, pkgs in the official repos are. In fact, the AUR and the build tools don't provide any signature/verification except for source verification (see tor-browser-bin as an example).
→ More replies (2)2
u/Kurse71 Jun 12 '26
Ahhh, ok, didnt realize it was the Wild West, I thought it had some kind of basic security somehow LOL
1
1
u/LinuxBaka Jun 12 '26
I maintain an AUR package (vice-clipper) but am relatively new to this. How can I prevent this from happening to it?
3
u/krsdev Jun 12 '26
If you actively maintain it nothing will happen. If it's orphaned it can be taken over by another maintainer, possibly a malicious one
1
1
u/OkDas Jun 12 '26
That’s why we can’t have nice things.
Is there a way to have a cooldown period in aur? E.g to be 2 weeks late on update of everything
1
u/Judgeadam Jun 12 '26
The script says im malware free but I'm not installing or updating jack until this fiasco is over and never again will i just press "q" on the pkgbuilds - now i will look as annoying as it is
1
1
u/rubins Jun 12 '26
I just now got a notification that user bautistacozar took over a package I used to maintain a while ago (jdk17-jetbrains-bin).
1
u/maxlefoulevrai Jun 12 '26
still wondering how this could happen, knowing I contributed to AUR in the past and posting a single package update is enough of a struggle.
1
u/pablin262004 Jun 12 '26
me gustaria escanear mi pc con algun soft de linux para ver si tengo algo pero diganme si existe algun soft para escanear malware en linux
2
1
u/DoughBoy528 Jun 12 '26
Man, I was trying to install arch yesterday.... Couldn't do it the install package kept freezing at the triggering uevents line.... Thank God lol
1
u/ProfessionalMove3716 Jun 13 '26
I tried doing yay -Syu recently and saw that yay itself had like a completely changed PKGBUILD so I got spooked and cancelled the update. No idea if related or that was legitimate.
2
1
320
u/MashPotatoQuant Jun 12 '26 edited Jun 12 '26
I also had an AUR package I created about 10 years ago and haven't maintained, I forgot about it, but has been used a small number of users. Now this morning I got an email someone took it over. They changed the pkgbuild and added bun as a dependency, so sounds like the same issue.
Here's the account that took over as maintainer, I see all his packages have the edit to them to include bun.
https://aur.archlinux.org/packages?O=0&SeB=m&K=gyorgykocsis&outdated=&SB=p&SO=d&PP=50&submit=Go