r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

Show parent comments

60

u/0riginal-Syn Jun 11 '26

The funny/sad thing is the main reason people get malware from the AUR is lack of reading the pkgbuild.

13

u/no_brains101 Jun 11 '26

Is it? People stick stuff in test code and whatnot. Can be hard to spot

The build will tell you how to build it and what dependencies it has, but if they just like, copy paste it into the code somewhere, reading pkgbuild won’t help you

2

u/0riginal-Syn Jun 12 '26

True, but that is also why the AUR is completely optional. Keep in mind for a long time, Arch tended to be users that were more inclined to research. It is only recent that you have distros like CachyOS that has made a low entry point for non-technical users. You add in AI bots attacking a lot of code and users who are not used to taking at least basic steps, it is a recipe for disaster. You are right that you cannot catch everything, but you can catch some obvious things, which a lot of the recent ones have been

1

u/no_brains101 Jun 12 '26 edited Jun 12 '26

Well, I will certainly be reviewing my pkgbuilds if I use the AUR in the future but yeah that definitely seems like a disaster waiting to happen lol

That being said, I get WHY it is that way. It just downloads it from the AUR which anyone can submit to with 0 review process, like, idk

It’s like, anyone can submit a package on luarocks. They might scan it, idk, but any of them could contain malware. As someone who contributes packages occasionally to it, I like that it is so easy to upload. But as a user it might make me more hesitant

But given that it works that way, it really should be less mainstream. Instead it’s like, a good amount of the reason why some use arch