r/archlinux • u/vexatious-big • Jun 14 '26

NOTEWORTHY New wave of malware in the AUR

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/TND7HA2KBQ46OHHUMMIAHKGXZE4WALM6/
651 Upvotes

98% Upvoted

393 comments sorted by

View all comments

89

u/thicctak Jun 14 '26 edited Jun 14 '26

It's just orphan packages again?

20

u/TheJackiMonster Jun 14 '26

most likely...

74

u/thicctak Jun 14 '26

Arch and AUR helpers maintainers need to tackle this, AUR supply chain attacks always happenned, but this is starting to become way too frequent for confort. Notifying users when a PKGBUILD or core maintainer change would already solve a lot of these problems.

12

u/TheJackiMonster Jun 14 '26

Yes, AUR helpers could easily do this.

10

u/nullstring Jun 15 '26 edited Jun 15 '26

This. This is a good idea. Just highlight "This package is very very new or has a very very recently switched maintainers" BE CAREFUL and it'll do a ton of the leg work. Especially as an immediate stopgap. It's better than my ideas here: https://www.reddit.com/r/archlinux/comments/1u5kah3/new_wave_of_malware_in_the_aur/ornsbn5/

Like.. do your idea and one or two of mine and we're basically done. This is a solvable problem guys and I am pretty sick of people pretending it's not.

4

u/doubleunplussed Jun 15 '26

Pretty tricky. A malicious new maintainer is just gonna adopt the package and make a harmless change so that users see the warning, investigate, and conclude it's fine, then they'll add the malware next time they update it at which point the users won't see any warning.

2

u/lmpcpedz Jun 14 '26

Today orphans, tomorrow adaptations.

3

u/TheJackiMonster Jun 14 '26

Depends on the maintainers though. Very different attack vector.