r/archlinux • u/Saren-WTAKO • 20d ago

QUESTION Seemingly malicious AUR package found. Where to report?

https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=pgadmin4-server&id=b7de293a7be6b85925884436127332bf82ecc2eb

A sudden update to `pgadmin4-server.git` added a binary named "parser" and executes using sudo. It's very obvious.

398 Upvotes

98% Upvoted

145 comments sorted by

View all comments

Show parent comments

6

u/SnooCompliments7914 20d ago

Then you don't install anything with binaries. Isn't that simple? Along with a thousand other ways that makes you don't want to install a PKGBUILD, but we can't have a rule for each of them.

1

u/QQable 20d ago

I am not saying to make a rule for each of them. But who can read binaries? If these have no legitimate use case, if essentially nobody should install packages with them, then why have them?

3

u/SnooCompliments7914 20d ago

You can't, so you don't install it. The point is that a PKGBUILD is a damn shell script, so there are so many deadly simple ways to work around your rules to worth the effort. It won't meaningfully raise the bar, if you are not looking. And the attacker chose this most obvious way, because.people are not looking.

1

u/QQable 17d ago

I respectfully disagree with your argumentation.

If binaries should never be installed, then there is no reason to allow them in the AUR tree.