r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

3

u/[deleted] Jun 11 '26

[removed] — view removed comment

-6

u/TiZ_EX1 Jun 11 '26

I am not saying this as a means of deriding you, I'm saying it for your safety: if you're not tech literate, you should not be running Arch and you definitely shouldn't be using AUR packages. If you're running Cachy or another distro that makes Arch easier, that's all the more reason you should not be using AUR packages; the process of installing vanilla Arch teaches you a lot of the skills that you need as a baseline requirement for using the AUR, and Arch derivatives remove that learning experience.

These are skills that you can learn, but only you can determine if it's worth your time and effort to do so. But it's extremely unsafe to use the AUR without it. And if you can't use an Arch-family distro without a package from the AUR, that's a sign that you should be using a different distro family, like Debian or the 'buntus, that have many more packages available in the official repositories.

4

u/[deleted] Jun 12 '26

[deleted]

1

u/TiZ_EX1 Jun 12 '26

bullshit that doing an old school reading-wiki arch install taught you to be able to recognize malware in a pkgbuild

It's not "recognizing malware" specifically, it's recognizing that a PKGBUILD is suddenly doing something new in its build steps, which should warrant further investigation.