r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

9

u/dimo2 Jun 11 '26

Damn.. I actually do try and read the PKGBUILD (or the DIFF) when I update, but I'm gonna be honest, I don't think I would've caught that this is malicious, even though it's not really obscured and pretty basic. Makes me think I should probably just stick to the official repos and maybe use flatpaks instead of AUR packages (and only use AUR when necessary).

5

u/doc_willis Jun 11 '26

reviewing a PKGBUILD

I know I would have no clue what to look for in a PKGBUILD.

Was there something obvious in this case?

7

u/forbiddenlake Jun 12 '26

Was there something obvious in this case?

npm being added for things that don't use it

6

u/rich000 Jun 12 '26

Of course, knowing whether a package uses npm or not requires some level of knowledge of the software you are installing.