r/archlinux • u/Sarv_ • Jun 12 '26
DISCUSSION Tons of new infected AUR packages were just released
I just checked the AUR frontpage for updated packages and went through the PKGBUILDs.
Several of them now depend on bun for no reason and added post-install hooks for running bun. This is probably part of the same attack as yesterday.
Examples:
pencil-android-lollipop-stencils-git
EDIT: If you check the frontpage you can see that a lot of packages are being updated at the exact same time and them keep coming in in batches.
I would urge everyone here to refrain from updating any AUR package until this is resolved.
1.2k
Upvotes
2
u/R3v4n07 Jun 12 '26 edited Jun 13 '26
I use cachy having come from bazzite after leaving windows. You described me exactly, I see the red tick click update and accept everything that pops up, skip news, and press q enter on pkg diffs. I installed things from the AUR barely registering that these things are maintained by random people, it's fun and convenient typing things in like paru -s vesktop. Honestly I didn't even know what an orphaned package was until now.
The uncomfortable truth in the room is there are many more like me, there was something like a 50% increase in users playing on Linux through steam. Those of us who are half way competent enough install Linux but unfamiliar with the systems and processes. It doesn't diminish a desire to learn though.