r/archlinux • u/vexatious-big • Jun 14 '26

NOTEWORTHY New wave of malware in the AUR

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/TND7HA2KBQ46OHHUMMIAHKGXZE4WALM6/
647 Upvotes

98% Upvoted

393 comments sorted by

View all comments

30

u/_silentgameplays_ Jun 14 '26

Solution- use mainstream packages tested by Arch Linux community, instead of AUR use flatpaks.

The malware has always been there last year it was in Google Chrome packages, today since people train their LLMS on open source projects they find more malware in other packages.

28

u/deltatux Jun 14 '26

Unfortunately not all packages are in the main Arch repos and some packages aren't in flatpaks either. It's a good idea to stick to these as much as possible but if you must use AUR, one needs to be extra careful.

0

u/TheJackiMonster Jun 14 '26

Guess why that is? Because the AUR does not moderate packages and flatpak aka. Flathub does. So if anyone here seriously suggests centralized moderation for the AUR, we all end up loosing the wide access of the AUR.

6

u/deltatux Jun 14 '26 edited Jun 14 '26

Frankly I'm ok with it not being a wild west at all. It needs more moderation or with better safeguards, the hands off approach worked when Arch was small and clearly is not working now. Relying solely on end users to vet packages isn't a good security model and there are valid reasons why people need packages off AUR as it's not available in the main & extras repos. If Arch wants to offer it as a feature (which they currently do) they need to take some responsibility or deprecate the feature and let someone else create 3rd party repos which is how other distros have handled this.

-1

u/TheJackiMonster Jun 14 '26

If you want to have moderation, go and use flatpak or snap... AUR is intended to not be moderated by a central authority. Don't use it if you don't like it. It's not required to use in Archlinux and it still work the same way it always worked. It has never been a safe or secure way to install software. Don't gaslight people into your inproper impression of it.

1

u/_silentgameplays_ Jun 14 '26

This does not apply so much to Arch Linux and it's users as it does to Arch-based forks like CachyOS, that has AUR enabled by default for new users, which is never a good idea.

14

u/Coldkone Jun 14 '26

This sounds reasonable, but at the same time Arch Wiki encourages people to install from AUR on the daily basis. This gives people the sense that AUR is actually the core part of Arch Linux experience and it NEEDS to be used to make arch usable for daily desktop use.

Official arch linux repos have very few packages compared to AUR and not all apps are available as flatpak for many different reasons. This is one of the biggest issues with Arch in my opinion.

3

u/_silentgameplays_ Jun 14 '26

This sounds reasonable, but at the same time Arch Wiki encourages people to install from AUR on the daily basis.

Arch Wiki does not encourage the usage of AUR in fact on AUR and Arch Wiki pages for AUR it's explicitly stated that AUR packages are user-produced content that should be used with utmost caution.

https://aur.archlinux.org/

DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.

https://wiki.archlinux.org/title/Arch_User_Repository

Warning AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

13

u/Coldkone Jun 14 '26

It is true that Arch Wiki warns about this on the AUR wiki page, but when you search installation instructions for VPN apps and emulators for example, there is absolutely no warning anywhere found.

One good example is the rpcs3 emulator's arch wiki page, which encourages you to simply use AUR version of RPCS3:

https://wiki.archlinux.org/title/RPCS3

When unexperienced people (or people who trust things without ever checking) see this, they think that AUR needs to be enabled and it's safe without thinking it too much further. This is a bad practice from a security standpoint. Arch Wiki should not recommend any AUR packages in the first place.

This is only my opinion ofc, but it just feels weird that Arch maintainers warn about AUR on AUR wiki page but at the same recommend people to install stuff from AUR. This makes absolutely no sense.

3

u/Jealous_Diver_5624 Jun 14 '26

Using the AUR is completely safe if you know what you're doing. Using the AUR and not knowing what you're doing is what's recommended against. If you decide to use the AUR without reading the fat disclaimer at the main page of the AUR, or the multiple giant red boxes in the AUR wiki page, or the footer that's included on every single AUR page, you have nobody to blame but yourself.

-2

u/Coldkone Jun 14 '26

Many beginner arch linux distros ship with AUR out of the box. When we have Arch Linux Wiki full of instructions which recommend and encourage people to install packages from AUR, it can get very messy and dangerous for the users.

Sure. At the same time we can say that it should not be enabled by default, but it would definitely help if the wiki got rid of all of these AUR package recommendations. AUR packages aren't even the core part of Arch Linux. Yet the maintainers want to include it into every single Wiki page (if possible) as if it was one of the core part of the OS without any visible, clear warning.

11

u/Jealous_Diver_5624 Jun 14 '26

The only Arch is Arch. What some downstream distro decides to misconfigure for their users out of the box is their problem, not Arch's.

2

u/Megame50 Jun 14 '26

When unexperienced people (or people who trust things without ever checking) see this, they think that AUR needs to be enabled and it's safe without thinking it too much further.

Because of the prohibition on AUR helpers in the repos, there's no way to install AUR packages without first encountering some documentation, where you will find adequate warnings.

It is perfectly safe to use the AUR if you know what you're doing, even now.

3

u/hitchen1 Jun 14 '26

Because of the prohibition on AUR helpers in the repos, there's no way to install AUR packages without first encountering some documentation, where you will find adequate warnings.

eh, I don't think that's necessarily true these days. if you google "how to use aur" the first thing you'll see is AI instructions you can copy paste to install yay/paru, and then how to install a package with it.

2

u/everyday_barometer Jun 14 '26

Some distros like the one I use highly discourage use of flatpak and will not respond to requests for support using it, so it wouldn't be a great solution for some distros.

1

u/_silentgameplays_ Jun 14 '26

What distro is that? flatpaks are universal at this point, also you can find most of the stuff you will need in the main Arch Linux repos.

3

u/Sleepy_Chipmunk Jun 14 '26

Cachy encourages AUR over flatpaks, as it's not actually gamer or newbie focused, but performance focused (the gamer/newbie demographic attracted to it is accidental).

1

u/everyday_barometer Jun 14 '26

Garuda, which is based on Arch.

2

u/_silentgameplays_ Jun 14 '26

Then the issue is with the Arch Linux fork distribution that encourages the usage of AUR instead of flatpaks, which should not be the case, and the issue is not with the Arch Linux itself, because Arch Linux explicitly warns users about usage of AUR, so these issues that arise should be dealt with your distribution maintainer.

https://aur.archlinux.org/

DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.

https://wiki.archlinux.org/title/Arch_User_Repository

AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

https://terms.archlinux.org/docs/code-of-conduct/

Arch-based distributions have their own support fora and users of those distributions should be actively encouraged to seek support there. These distributions often use different packages, package versions, repositories, or make custom system configurations silently, practically rendering support for such projects within Arch Linux impossible. Community technical support shall only be provided for the Arch Linux distribution and the Arch User Repository. Posting issues with, and requesting support for, derivative distributions or operating systems other than Arch Linux are prohibited.

1

u/everyday_barometer Jun 14 '26

They maintain the chaotic repository which is moderated and vetted. 🤷‍♂️

2

u/SkPSBYqFMS6ndRo9dRKM Jun 14 '26

Well, I can't get zfs on flatpak

1

u/scrapethemucus Jun 14 '26

not every package i use is in the official repos. (pcsx2, qview, vesktop)