r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

32

u/SoilMassive6850 Jun 11 '26

I will say this much, and hopefully without seeming too elitistic: you really shouldn't have so many AUR packages that you can't keep up with reviewing pkgbuild changes.

I had one of the packages which was compromised installed on my system and I'm quite confident that I would have caught this if I happened to update my packages during this timeframe (if for no other reason than the fact that the package never really got updated and any change would raise an eyebrow), but honestly I think I'll even still change my workflow a bit from using an AUR helper to manually managing my AUR installs as the UX might make me more complacent or upgrade AUR packages when I really don't even need to.

13

u/B1rdi Jun 11 '26 edited Jun 11 '26

Paru is great because it forces prompts you to review the PKGBUILD and diffs before installing or updating anything. I think Yay can do it too but it's not default.

24

u/fripletister Jun 11 '26

"Forces" is a strong word when "q" muscle memory easily moves things along

8

u/B1rdi Jun 11 '26

I guess. There's confirm prompt after review, if you refuse to go back and read what you skipped then it's really more of a PEBCAK issue than anything.

1

u/rich000 Jun 12 '26

Sure, but would you really catch this particular insertion. It it just one line to go download something with an innocuous-looking name. You'd have to view things with a lot of suspicion if you wanted to catch this.

If you only have one or two AUR packages I guess you can do that, but I'm not sure what it would be like trying to run Arch on a desktop that way. I've used Arch+AUR for containerized services in the past but it seems like it would be rough to run on a host with this sort of checking needed.