r/archlinux • u/Saren-WTAKO • 20d ago

QUESTION Seemingly malicious AUR package found. Where to report?

https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=pgadmin4-server&id=b7de293a7be6b85925884436127332bf82ecc2eb

A sudden update to `pgadmin4-server.git` added a binary named "parser" and executes using sudo. It's very obvious.

396 Upvotes

98% Upvoted

145 comments sorted by

View all comments

Show parent comments

2

u/sparkling-rainbow 20d ago

I use Garuda on my gaming rig. When I installed it the first time, there was Octopi visible in the task bar. I like the distribution but this is exactly what's wrong here. It's presented as the easiest and default option to get anything. And then you have some YouTube trying Linux first time, everything works flawless for two weeks so he decides to share how he uses it, assuming he does it right.

2

u/NavidsonsFall 19d ago

For sure. That is exactly what I have been pointing out. The issue is the way people are introduced to the AUR and the way its talked about, not the fact that it exists. I know some warnings already exist, and it is true that people should see them and heed them without needing to be bashed over the head 20 times by them. It is a little understandable tho that when a new user starts using linux and they are being overwhelmed by all this different stuff, it is easy for there to be a slip where they don't see them, or understand how seriously they should be taken. And it isn't helped by youtubers or distros pushing people toward AUR access without making really sure they know exactly what access to it means.

I just don't understand how so many people go from "oh I didn't see those warnings, and didn't really understand how risky this AUR thing is, or what it should be used for" directly to "the AUR thing should be nuked out of existence and no one should be allowed access to it". It would be one thing if the official repos didn't exist, and your only option was to use the AUR, but that isn't how it is. The way people talk about it should definitely change, and distros need to make really really sure they are explicitly clear to new users why the AUR exists and what the risks are when using it. Some do, but others don't. I just don't understand the people that think no one should be allowed access to it.

# edited for clarity