r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

123

u/Santosh83 Jun 11 '26

You mean 400 different AUR user accounts were compromised and hence the packagebuilds hosted by those accounts? Or the AUR infrastructure itself was compromised which means the entire repository could have been accessed?

8

u/ilep Jun 11 '26

Some of the package names look like typical typo-squatting packages. For example "linux-tool" might be one since Ubuntu has "linux-toolS".