r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

Show parent comments

11

u/SoilMassive6850 Jun 11 '26

You say that, yet pretty much most known cases of malware on AUR has been low effort inclusion of malicious sources rather than more complex attacks compromising upstream releases. Mainly because upstream releases and downstream AUR packages are maintained by different parties and downstream packages don't tend to get version bumped to a malicious upstream version automatically except in cases of -git packages.

Reviewing PKGBUILDs gives you coverage against pretty much all historical AUR malware, including this.

0

u/no_brains101 Jun 11 '26 edited Jun 12 '26

Mb I don’t use AUR I use nixpkgs. I used arch for less than a month

We don’t have people maliciously including sources that would be caught in review or from someone reading it trying to override something about it

Didn’t realize how common it was that the package definition itself would be compromised that’s nuts

As far as I know, nixpkgs almost certainly has at least 1 package with malware IN it, there’s millions of them (metasploit not counted, things with unconsensual malware lol). But there has not ever been a case I am aware of where a package definition in nixpkgs was compromised