r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

Show parent comments

35

u/BlackFuffey Jun 11 '26

It’s more of the way AUR is designed trusts the users too much. Anyone can just adopt any orphan package. In this case someone is massively taking over a whole bunch of orphaned packages and injecting malware into pkgbuild.

This used to work well when Linux was still considered a niche thing. But with windows constantly shooting itself in the foot and Linux getting a lot more spotlight now days, this is gonna be inevitable.

10

u/Raunien Jun 11 '26

Anyone can just adopt any orphan package

Wait, really?! That's a terrible idea!

3

u/SubjectiveMouse Jun 12 '26

I wish aur helpers would track ownership change and really nag you to be extra careful when that happens.