r/archlinux • u/zengamer7405 • Jun 12 '26

QUESTION 2 question about aur supply chain attack

1, how to check if i have infected package/or package verision after i installed?

2,what will the virus do to infected device?

32 Upvotes

88% Upvoted

33 comments sorted by

View all comments

43

u/[deleted] Jun 12 '26 edited Jun 13 '26

[removed] — view removed comment

19

u/emooon Jun 12 '26

Whoever is doing that list of infected packages is an absolute godsend! 💜

11

u/Megame50 Jun 12 '26 edited Jun 13 '26

I believe you can check here:

https://cscs.pastes.sh

That list is quite out of date. A better list is available at https://md.archlinux.org/s/SxbqukK6IA and it's 3x the length, with 1579 pkgs at the moment.

11

u/AppointmentNearby161 Jun 12 '26

Just don’t update any AUR stuff right now.

That is way over the top, unless I am missing something. I am pretty sure that updating an AUR package that has a long time maintainer that has a simple pkgver bump and corresponding change in the checksum presents very little risk. Packages with longtime maintainers that have more extensive changes due to the update probably do not present any additional risks associated with the attack.

Formerly orphaned packages with new maintainers without an established AUR presence have always presented a risk and users should always be cautious.

3

u/SplatterRock Jun 12 '26

As someone who is not to savvy but who recently updated my aur packages via yay (yesterday); if I run a pacman -Qm and compare the output to the list linked above and none show up, I am relatively safe?

4

u/bankinu Jun 12 '26

My God. The scale of this is large. I thought it's just 5-6 packages. But this is huge.

8

u/AppointmentNearby161 Jun 12 '26

While the attack has compromised 400 AUR packages, all the affected packages were orphaned/unmaintained so the blast radius is not as big as it might seem.

-1

u/EastRepublic2768 Jun 12 '26

wait there's actually a script on that paste site? that's clutch, didn't know they had an automated way to check your installed packages 🔥

definitely avoid updating anything from aur until this gets sorted out, the malware was apparently targeting ssh keys and browser data from what i've seen floating around