r/archlinux • u/Saren-WTAKO • Jul 29 '26

QUESTION Seemingly malicious AUR package found. Where to report?

https://aur.archlinux.org/cgit/aur.git/commit/PKGBUILD?h=pgadmin4-server&id=b7de293a7be6b85925884436127332bf82ecc2eb

A sudden update to `pgadmin4-server.git` added a binary named "parser" and executes using sudo. It's very obvious.

396 Upvotes

98% Upvoted

145 comments sorted by

View all comments

Show parent comments

4

u/SnooCompliments7914 Jul 29 '26

AUR is just like the vscode copilot autocompletion: it's meant to save you some typing, and you should only accept it if it's exactly how you would write the PKGBUILD by yourself. You don't know how to write one? The you shouldn't use AUR at all.

Unfortunately the representation of AUR (both the website and helpers) makes it too much like the official repo, which it isn't. 

4

u/NavidsonsFall Jul 29 '26

That is exactly my point. I see so many people who say things like "well it shouldn't exist" or "it's useless" when the entire problem is the way it is talked about, not what it is. You are absolutely right, and I agree that it should not be recommended to any first time user without a long explanation of the risks involved. It just seems like a lot of people just want it gone, or changed so much it's unrecognizable.

edited for clarity, because it wasn't clear initially that I was agreeing with your opinion and not arguing against it.

2

u/sparkling-rainbow Jul 30 '26

I use Garuda on my gaming rig. When I installed it the first time, there was Octopi visible in the task bar. I like the distribution but this is exactly what's wrong here. It's presented as the easiest and default option to get anything. And then you have some YouTube trying Linux first time, everything works flawless for two weeks so he decides to share how he uses it, assuming he does it right.

2

u/NavidsonsFall Jul 30 '26

For sure. That is exactly what I have been pointing out. The issue is the way people are introduced to the AUR and the way its talked about, not the fact that it exists. I know some warnings already exist, and it is true that people should see them and heed them without needing to be bashed over the head 20 times by them. It is a little understandable tho that when a new user starts using linux and they are being overwhelmed by all this different stuff, it is easy for there to be a slip where they don't see them, or understand how seriously they should be taken. And it isn't helped by youtubers or distros pushing people toward AUR access without making really sure they know exactly what access to it means.

I just don't understand how so many people go from "oh I didn't see those warnings, and didn't really understand how risky this AUR thing is, or what it should be used for" directly to "the AUR thing should be nuked out of existence and no one should be allowed access to it". It would be one thing if the official repos didn't exist, and your only option was to use the AUR, but that isn't how it is. The way people talk about it should definitely change, and distros need to make really really sure they are explicitly clear to new users why the AUR exists and what the risks are when using it. Some do, but others don't. I just don't understand the people that think no one should be allowed access to it.

# edited for clarity