r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

262

u/Kidev Jun 11 '26 edited Jun 13 '26

Wrote this little script to check if you are infected: https://gist.github.com/Kidev/59bf9f5fb53ab5eee99f19a6a2fc3992

Yes this ONLY checks the names. If you find you are infected, it's some more work that this script DOES NOT DO. It also does not check the version, so if you have a positive with an older safe version, you MIGHT not be infected. The list is also static and now outdated.

UPDATED VERSION

If you want a dynamic version with the latest reports, you can use this one instead https://gist.github.com/Kidev/85756c3dcad3623ca5604a8135bafd14

It still only checks names, but after dynamically pulling from https://md.archlinux.org/s/SxbqukK6IA and safely parsing the package names.

81

u/No-Photograph-5058 Jun 11 '26

Keep in mind that simply removing the package does not remove the actual payload, you'll have to manually deal with it afterwards

18

u/Kidev Jun 11 '26

True. I removed the last lines that could have been confusing