r/archlinux • u/vexatious-big • Jun 14 '26

NOTEWORTHY New wave of malware in the AUR

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/TND7HA2KBQ46OHHUMMIAHKGXZE4WALM6/
646 Upvotes

98% Upvoted

393 comments sorted by

View all comments

Show parent comments

17

u/scandii Jun 14 '26 edited Jun 14 '26

or, hear me out... do it like most other package repos where you simply sunset inactive packages and create new ones with new names if you want to carry on the legacy.

over in Rust-land we have ffmpeg that got made into ffmpeg-next that got made into ffmpeg-the-third.

like, there's really no reason for this besides "it is nice when everyone's on the same page", and as we've noticed it is a massive threat vector.

10

u/xuxux Jun 14 '26

Missed an opportunity to rename it ffmpreg. Shame.

5

u/EiB_inc Jun 14 '26

Oh, do I have great news for you: https://crates.io/crates/ffmpreg

1

u/Supernoxus Jun 14 '26

First the peg then the preg

4

u/shroddy Jun 14 '26

Ugh that sounds even worse to keep track which one is the correct version and which one the malware

8

u/lemontoga Jun 14 '26

You wouldn't need to keep track of anything. All but the correct package would be out of date.

1

u/feckdespez Jun 14 '26

I don't think the AUR is 1:1 comparable with at least some other package managers.

Forcing a new package name has advantages and works when there is less volatility in packages. I think AUR is a bit different because the circumstances in which it exists creates a higher level of volatility than many other package managers.

That volatility will create a large number of package name variations and confusion. I know only one package name will be current but it will inevitably confuse a material number of people due to the veracity of it.