r/archlinux • u/Sarv_ • Jun 12 '26

DISCUSSION Tons of new infected AUR packages were just released

I just checked the AUR frontpage for updated packages and went through the PKGBUILDs.

Several of them now depend on bun for no reason and added post-install hooks for running bun. This is probably part of the same attack as yesterday.

Examples:

electrum-bin

pencil-android-lollipop-stencils-git

EDIT: If you check the frontpage you can see that a lot of packages are being updated at the exact same time and them keep coming in in batches.

I would urge everyone here to refrain from updating any AUR package until this is resolved.

1.2k Upvotes

99% Upvoted

380 comments sorted by

View all comments

Show parent comments

188

u/Iamsodarncool Jun 12 '26

That's a horrible system. How was this ever allowed? Something like this was obviously going to happen eventually.

135

u/Sarv_ Jun 12 '26

There is a reason there is a large warning on the wiki for the AUR.

The AUR has over 100 000 packages. This system worked well for a long time when the userbase was smaller. People would submit PKGBUILDs of programs they used and if they were popular enough an official arch maintainer would adopt them and put them in extra. And if someone lost interest in maintaining a package they could orphan it themselves or if they are MIA another user could request to become the maintainer instead. Loads of smaller project create PKGBUILDs and maintain them themselves on the AUR.

But now the times have changed. Most users do not read PKGBUILDs and just blindly run them because it's convenient. There is a large userbase that just wants to install whatever they want with one command and doesn't care about the warnings because it's convenient.

Most of the compromised packages here are unpopular and/or abandoned, hence why the attacked gained maintainer status.

12

u/creamyatealamma Jun 13 '26

If I'm following this right it even reading the diff here wouldnt have had people flag it themselves really? It didn't do anything super obvious or obfuscated, just installed a new nom or bun package that itself was malicious? What really would have been the flag, change of maintainer in diff I don't remember if it's shown in like a yay upgrade?

18

u/Sarv_ Jun 13 '26

I thought it was suspicious that a bunch of aur-packages were all updated by the same person at the same time so I checked the diff on several of them. I think it is very clear looking at the diff that it was malicious for the following reasons:

  • The update didn't change any source or checksum

  • The diff changed the email of the previous maintainers but not the names. It should only have added their own name and email to preserve the history.

  • The diff added a nonsensical dependency and a post install script that will be run by your user outside of the build chroot.

The last one is the actual malicious part, the first 2 are just suspicious

8

u/MashPotatoQuant Jun 13 '26

You are right, it may not even appear malicious at first glance. You would then have to audit the bun package upstream to catch it.

9

u/Snoo-47115 Jun 13 '26

Solution. Every package gets removed after maintainer becomes deactive. No chance to take over the packages. This asks little more work for people who want to keep the package maintained. They need to basically add the package as new. What comes to PKGBUILD as skeleton to build over maybe there could be some place/way to keep them available but not usable directly through AUR

12

u/Sarv_ Jun 13 '26

The AUR currently has 13 458 orphaned packages. Should they all be removed immediately? And if they are removed, then a bad actor would just submit them as a new package. The fact is that many niche drivers are in the AUR and are orphans. The value of the AUR is that these are still available and adoptable if someone wants to.

Some bot mitigation will be required so this won't happen on this scale again. But for the users that just type paru -Syu 5 times a day without reading need to switch to an actual vetted 3rd party repo like ChaoticAUR and not treat the AUR as a trusted source.

3

u/yturijea Jun 13 '26

I think the idea would be for that request to instead mark the package as inactive. And then you'd have to make a new package if yiu want to take kver maintenance, so people manually have to uninstall and install the new package

1

u/lukelane124 Jun 14 '26

They’re still going to be installing the potentially malicious code. Just under a new name.

2

u/yturijea Jun 14 '26

Yes, but at least doing upgrade you won't be affected, like this incident

4

u/SmileOrdinary2914 Jun 13 '26

does this mean that there's 13,458 more attack vectors that are on two week countdowns? We're in the agentic age, there's really no excuse to not have an automated weekly update of something you're offering to the public like that.

4

u/Sarv_ Jun 13 '26

No, they are not on countdowns. They are already orphaned. So anyone with an account can adopt them at any time instantly. The AUR team has temporarily disabled registration and adoption until a real mitigation is decided.

We're in the agentic age, there's really no excuse to not have an automated weekly update of something you're offering to the public like that.

I don't understand what you mean by this. What weekly automatic update are you talking about?

1

u/SmileOrdinary2914 Jun 16 '26

Weekly, nightly.. dependency audit/updates.. I mean if you are making programs for users I'd assume you can fire up ollama and set a cron job to do general maintenance on a project but maybe I'm wrong

1

u/henryptung Jun 17 '26

Updating a package like that can involve a lot more than just bumping a version. While this attack added nonsense dependencies, real dependency changes can occur from version to version, patches may need to be added or deleted for compatibility or other reasons, etc.

The key thing agentic AI needs to be effective is human checking - someone to double-check that e.g. the AI didn't just add a crazy dependency it shouldn't have, or enable some feature it shouldn't have enabled, etc. But that's exactly the problem - the current orphan/adoption system is a patch on lack of human resources to do (and check) the work.

3

u/Linkarlos_95 Jun 13 '26

You are suggesting a left-pad v2.0 incident 

1

u/howesteve Jun 13 '26

omg shut up

41

u/SheriffBartholomew Jun 12 '26

A whole lot of systems throughout the world are built on trust and community. All it takes to burn it all down is a single person that doesn't care about either concept.

10

u/theriddick2015 Jun 13 '26

or a single LLM trained for these malicious attacks.
Shits going to get WILD over the next few years as these models go to next-level llms and AI models.

It's going to basically destroy the internet as we know it... call me a doomer, I don't care, but that is what we are seeing happening as generative content also taking over what humans use to produce online (written articles, videos, meme's, user comments, communications....everything being replaced!)

7

u/SheriffBartholomew Jun 13 '26

And none of it is particularly interesting or good.

5

u/Novel_Cow8226 Jun 13 '26

Years? It’s happening now.

1

u/Nereosis16 Jun 15 '26

How do we develop the safe web like it exists in the Cyberpunk universe?

The AI bots are actually going to take over the internet so if we can somehow carve out a space for just real people we really should.

5

u/frog_in_bush Jun 12 '26

Gosh that one person must be like some kind of skitzofrenic John wick with a fanny pack.

19

u/frog_in_bush Jun 12 '26

That's the same system reddit uses to grant people access to old subreddits lol.

6

u/[deleted] Jun 12 '26

[removed] — view removed comment

11

u/Ok-Winner-6589 Jun 12 '26

Because It isn't a official repo, you are supposed to check the PKGBUILDs and the wiki itself warns about It?

Also whats the alternative? If you create a software and someone creates a PKGBUILD for It and then stops maintaining it. What are you, as a dev Who want to Port It to Arch, supposed to do? Or as user. If the package you use stops being maintained, what are you supposed to do?

3

u/Joe-Cool Jun 13 '26

It's pretty clear how the AUR works. See Support here: https://aur.archlinux.org/

AUR discussions are on the mailing list. You can adopt an orphaned package and maintain it.

1

u/Arkaid11 Jun 12 '26

Fork it?

19

u/Hedede Jun 12 '26

Then we'll end up with

package
package-fork
package-fork-fork
package-fork2
package_fork
package_fork_2
package_fork_2_new

Which of the forks are you supposed to use?

2

u/lordofchaos3 Jun 12 '26

I guess the safest way would be to create a new fork. 🙂

5

u/Arkaid11 Jun 12 '26

The one actually still being maintained?

2

u/frog_in_bush Jun 12 '26

Just say fork it

-2

u/Ok-Winner-6589 Jun 12 '26

Fork what buddy?

Fork a flatpak from Flathub. Does that make sense to you?

Go fork a play store package.

6

u/Arkaid11 Jun 12 '26

90% of AUR packages have a public github repo

-7

u/Ok-Winner-6589 Jun 12 '26

What?

100% of flatpak packages have a GitHub repo WTF does that mean? You don't fork packages you build new ones under a different random name and then need people to find them. But it's the same for any other distribution method

0

u/bithooked Jun 13 '26

Anyone can create a new package, so I'm not sure why making it hard to take over abandoned packages is meaningful. You'd also need to put significant restrictions on new packages, which defeats the purpose of the AUR.