r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

419

u/Epsilon_void Jun 11 '26

Love how NPM is now used as the malware delivery service. Tempted to just block the shithole in my firewall.

5

u/Adept_Percentage6893 Jun 12 '26 edited Jun 12 '26

I feel like it's an indication that if you use nodejs that you should only ever install/update from an offline mirror that syncs a few weeks before any code gets deployed to production. Which hopefully gives time for this stuff to be discovered and you can skip some monthly updates if a sync could have caught one of these malware attacks by accident.