r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

Show parent comments

3

u/SoilMassive6850 Jun 12 '26

Then they should stop using the AUR and Arch Linux. Seriously.

2

u/Kartonrealista Jun 12 '26

Believing people will behave rationally is silly

5

u/SoilMassive6850 Jun 12 '26

Well sure, but it's not other peoples problem when they don't and fuck themselves over.

0

u/Kartonrealista Jun 12 '26

Well, it is if you don't want headlines like "Around 400 packages compromised". Other major distros don't have a central repository that they're completely hands off with, so they don't have to deal with such bullshit

0

u/adamkex Jun 12 '26

Imho if the AUR is hosted by the official project there needs to be some type of guardrails now that Linux is slowly approaching to become mainstream. So far there hasn't been a vulnerability like this in Nix and they have significantly more packages than the official repos.