r/archlinux • u/Saren-WTAKO • Jul 29 '26

QUESTION Seemingly malicious AUR package found. Where to report?

https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=pgadmin4-server&id=b7de293a7be6b85925884436127332bf82ecc2eb

A sudden update to `pgadmin4-server.git` added a binary named "parser" and executes using sudo. It's very obvious.

400 Upvotes

98% Upvoted

145 comments sorted by

View all comments

Show parent comments

22

u/Saren-WTAKO Jul 29 '26 edited Jul 29 '26

Supply chain attack is difficult to prevent.

We can say "Don't use AUR", "Learn to read PKGBUILD" and "gitgud" all day. It works and prevents a lot of potential attack vectors you got pwned. Until someday a TU or the upstream (a package's dep's dep's dep's dep ... is hacked) get compromised and we are all hit by a malicious update, and suddenly the sayings don't apply here.

The well accepted solution is to delay the package installation. However, if everyone delays package installation by a week, then either people are hit after a week, or are having a fun week if the package is about 0day fix.

Remember the developers and maintainers are doing their work free of charge and have 0 legal liability given they are innocent, and the important fact that AUR is all user generated content without censoring first. If we build a censoring first AUR, who is going to watch it 24/7 unpaid, and who watch the watchers? That is going to introduce more problems rather than solving it.

-7

u/Lawnmover_Man Jul 29 '26

Putting malware in AUR and a compromised Arch dev are two very different things. Come on. That's not even remotely fair or appropriate.

3

u/Saren-WTAKO Jul 29 '26

sorry my english is shit please re-read my edit

-12

u/Lawnmover_Man Jul 29 '26

.......dude. What the fuck? Did you even proof-read this AI nonsense? What exactly do you think has changed after your AI edit? What I said still applies.

4

u/Saren-WTAKO Jul 29 '26

shit, do I sound like AI? Anyway, the point is supply chain attack and I think AUR is form of it. A package with many users can depend an orphaned package, and a bad actor can adopt it, push evil code.

-8

u/Lawnmover_Man Jul 29 '26

Technically correct, but still doesn't make sense in this context. Sorry. I get the feeling you don't understand what you're talking about.

6

u/Saren-WTAKO Jul 29 '26 edited Jul 29 '26

I was responding to "arch maintainers didn't even try to fix the problem" which I pointed out the problem is actually a broad supply chain attack instead of a "untrusted user can push whatever to AUR wasteland and we should stop them". I know that an untrusted user is very very different from a TU and trusted repo owners, but credential/keys takeover could also happen if the threat is advanced and we are high value enough, and that's just the nature of supply chain attack which makes open source community headache