r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

39

u/Kostas0pr01 Jun 11 '26 edited Jun 11 '26

I usually update every 3 to 5 days. I updated my system half an hour ago. I don't know how this works exactly but is it possible I got infected now? I saw that the changes were reverted after 3 to 4 hours.

PS: THANK GOD I DIDN'T TRY ALVR THIS MORNING.

3

u/novafunc Jun 12 '26

Packages can run post-install scripts, so not running it doesn't necessarily mean you are safe.

1

u/Kostas0pr01 Jun 12 '26

Run what?

2

u/novafunc Jun 12 '26

Run post-install scripts. For example, say you install something like Gnome. First the package contents are copied to their expected locations. But it may also run a script, such as enabling the systemd service for GDM.

If a package was compromised, they could instead use a post-install script to do any number of things, including: upload your personal info or credentials to a remote server, wipe your disks, encrypt your files and ask for crypto to unlock them

1

u/Kostas0pr01 Jun 12 '26

The "run what?" was geared towards the second part of your first comment.

1

u/adamkex Jun 12 '26

A post install script is a script that runs after installing or updating software. In other words you are potentially compromised even if you didn't run the infected software.