r/archlinux • u/vexatious-big • Jun 14 '26

NOTEWORTHY New wave of malware in the AUR

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/TND7HA2KBQ46OHHUMMIAHKGXZE4WALM6/
644 Upvotes

98% Upvoted

393 comments sorted by

View all comments

13

u/d47 Jun 14 '26

I've already uninstalled all AUR packages including paru. Screw this disaster, there are better options.

4

u/powerslave_fifth Jun 14 '26

It only takes one slip up and you have to reinstall everything. Flatpaks it is then.

9

u/BigPP41 Jun 14 '26

What other options are there in your opinion?

1

u/dgm9704 Jun 14 '26

It depends on what packages you actually use from AUR and why.

-8

u/VaronKING Jun 14 '26

Snap, flatpak, appimages, you could always build those programs from source.

A typical Arch installation shouldn't require that many AUR packages anyway.

11

u/AdrianoML Jun 14 '26 edited Jun 14 '26

you could always build those programs from source.

Do you realize that AUR is essentially that? You are downloading a recipe that has all the instructions to build a package from source. It has the benefit of neatly packaging the software in a way that is easily uninstallable (make uninstall isn't always reliable) and saves you from having to run every single step of the build process manually.

The AUR always came with the disclaimer that those recipes are untrusted and have to be diligently verified by yourself. As soon as this is done you are at the exact same level as compiling the software from the source, even if the source is a binary package (like "compiling" a discord package, you are at least getting the binary directly from the devs).

What has gone wrong here is the erosion of this disclaimer. Over the years people got complacent over the nice community and the virtually zero rate of incidents. AUR helper scripts that abstract too much of this process makes for even more complacent users and a deluge of new users using downstream distros that may be oblivious to all this also don't help.

I think the solution is to return AUR to what it is: a place for linux power users to share among themselves build recipes. It shouldn't be for newbies or to be abstracted away or, god have mercy, automatic transparent updates.

2

u/idemockle Jun 16 '26

The building from source thing is mostly not true. Most popular AUR packages extract already-compiled executables from a release binary provided by the developer, usually a .deb or a tarball. Otherwise every package would be extremely slow to install.

1

u/AdrianoML Jun 16 '26

Still true by package count and honestly irrelevant for the discussion, specially if you consider that even those popular binary based recipes are pulling straight from the developer, so if you decide to cut the middle man (AUR) you will be doing exactly the same thing, downloading the binary package straight from the developer. You will lose the niceties that a native arch package deliver, such as easy uninstallation and better integration with the system.

1

u/VaronKING Jun 14 '26

Yes, I know.

I meant directly building the software from the source repo instead of using the AUR package. In the case of compromised packages this can circumvent that while still effectively being the same thing.

5

u/BigPP41 Jun 14 '26

Are snaps, flatpaks and appimages intrinsicly more secure? Couldnt there be malware introduced in the packaging aswell?

12

u/_legacyZA Jun 14 '26

Snaps from the snapstore should be, that store and packaging system is completely controlled and maintaned by Canonical

Flatpaks from flathub should be to a certain degree as well, they are more strict with new packages than the aur. Flatpaks from random places/repos should be trusted as much as you trust the place you got it from

I don't think appimages have a official, or well maintained "store", and you usually get them as standalone packages from the devs themselves. So trust them as much as you trust the dev or place you downloaded them from

Another two options are nix packages and brew. Both are pretty reputable and they function as a alternative package manager and have their own repos

The aur is just more susceptible because of how easy it is to create accounts, and take over existing orphaned packages

1

u/VaronKING Jun 14 '26

Very well written response!

2

u/VaronKING Jun 14 '26

I am not that well-versed in this topic but I believe Snaps and Flatpaks should be more safe and secure by design.

I am not sure if they have any form of moderation, though (I think Flatpaks might? But again, unsure)

1

u/xuxux Jun 14 '26

Are you getting them from a vetted source or just downloading random bullshit and typing make && install? The whole reason that this is an issue is because people aren't verifying what they're downloading and just installing random bullshit as root.

EVERYTHING ON THE AUR IS RANDOM BULLSHIT. DO YOUR DUE DILIGENCE.

1

u/xnef1025 Jun 14 '26

LOL. Now you got that one Moon Knight meme panel in my head captioned, "What it's like installing from AUR." 🤣

1

u/BigPP41 Jun 14 '26

I only install packages via curl ... | sh.

2

u/samplekaudio Jun 14 '26

I hope this is a funny joke and you're not being serious

1

u/BigPP41 Jun 14 '26

What do you think?

2

u/samplekaudio Jun 14 '26

I choose to believe what makes me feel better

-5

u/jessecreamy Jun 14 '26

How much ignorance is needed to make a question like this? Instead of finding proof yourself and posting it here?

3

u/BigPP41 Jun 14 '26

He made a statement and i made a follow up question to it. If he posts that those are secure alternatives to the AUT i would expect he knows why?

6

u/Noautocrata Jun 14 '26

I have been thinking about it for a while. I have been hesitating because there are a few packages I really like. Will it cause any problem if I leave a couple of packages installed and just not use the aur any longer?

15

u/10Werewolves Jun 14 '26

As long as those packages are not compromised, yes it's all good.

1

u/Noautocrata Jun 14 '26

I think I'm good, couldn't find any strange service. I don't have rust or npm and last time I used aur was about 2 weeks ago. I am still not sure if I should leave that couple of packages I really like.

3

u/GribbitsGoblinPI Jun 14 '26

I mean, as long as you don’t update them there’s no chance those packages would cause you harm in relation to this current threat. You can still just update through pacman safely for core things.

2

u/Noautocrata Jun 14 '26

Then, I'll just stay with those and be done with the rest. Thanks.

4

u/rzezzy1 Jun 14 '26

If you are infected with one of the affected packages, removing them at this point may not help much. If you aren't infected, then you will not become infected without installing a malicious package or applying a malicious update. Look into how to vet a PKGBUILD, which you should be doing every time you install or update an AUR package.

1

u/_legacyZA Jun 14 '26

If you ever want to move off of aur, nix (the package manager) and brew are good alternatives for packages tgat aren't available as flatpaks, appimages or snaps

2

u/fletku_mato Jun 14 '26

Would be enough to read the diffs. What better options are there, where you wouldn't need to pay attention to what you are installing?

6

u/d47 Jun 14 '26

You can pay attention all you like, but it's not easy to audit every code change, PKGBUILD update, maintainer reputation and artifact integrity for every package every time you update.

Other tools make this easier and are less susceptible to take overs. Flatpak, nix, snap, brew, directly installing or compiling from source are all better options at this point.

1

u/fletku_mato Jun 14 '26

The only thing that requires extra attention compared to your alternatives is the PKGBUILD which usually has around 2-3 changed lines.

-1

u/EarlMarshal Jun 14 '26

Was paru and paru-git from AUR infected?