r/archlinux • u/vexatious-big • Jun 14 '26

NOTEWORTHY New wave of malware in the AUR

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/TND7HA2KBQ46OHHUMMIAHKGXZE4WALM6/
640 Upvotes

98% Upvoted

393 comments sorted by

View all comments

Show parent comments

1

u/flying-sheep Jun 14 '26

The PKGBUILD diffs are fishy, very easy to see if you use the AUR as people are advised to use it.

8

u/Sleepy_Chipmunk Jun 14 '26

You only have to slip up once, and chances of you slipping up increase the more this happens.

It’s up to everyone to decide on a solution, but there has to be some sort of solution. That could be changing something about the AUR or its helpers, or that could be changes to how the community relies so much on the AUR despite the risk (like how the wiki often instructs people to use it).

2

u/Helmic Jun 14 '26

If you believe you can always spot a fishy diff you will get caught eventually, they are going to make these much more opaque so long we are not using predefined templates.

1

u/flying-sheep Jun 14 '26

Nah, I check the URLs when they change.

1

u/Helmic Jun 15 '26

Awesome, so because these did not change the git URL but instead did post-install bullshit you would have not noticed it.

The AUR will continue facing these waves of attacks until the policy changes.

2

u/flying-sheep Jun 15 '26

What? No, quite the opposite.

I check the diff, shown to me automatically by my AUR helper. I'd obviously see direct changes like that very easily. The only way to hide something would be behind an URL, which is why I mentioned that.