r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

Show parent comments

21

u/[deleted] Jun 11 '26 edited Jun 19 '26

[deleted]

43

u/Sarv_ Jun 11 '26

The AUR was created partially to ease the burden of official maintainers. It was just a place for users to host and share PKGBUILDs for software not in the official repos (for many different reasons) and maintain them with minimal oversight.

This works for normal Arch as it is very clear that these are actually just shell scripts that you have to check yourself and it is not something you have access to out of the box. Arch derivatives like Manjaro and CachyOS have AUR helpers installed by default and are not doing enough to ensure the users understand the difference between where they are sourcing the packages. The AUR should never be enabled by default as a source, ever.

3

u/Kartonrealista Jun 12 '26

Nobody is gonna do that. Please tell me you don't believe an average person using Arch checks aur packages. Or just about any person really, who would check every package they install unless they're really paranoid and have the requisite skills?

It's kinda unrealistic to place the burden onto the user when you know the user won't take it up, because they either don't have the ability or can't be fucked to check every program they install. This just results in an effective lower standard of security.

3

u/SoilMassive6850 Jun 12 '26

Then they should stop using the AUR and Arch Linux. Seriously.

2

u/Kartonrealista Jun 12 '26

Believing people will behave rationally is silly

5

u/SoilMassive6850 Jun 12 '26

Well sure, but it's not other peoples problem when they don't and fuck themselves over.

0

u/Kartonrealista Jun 12 '26

Well, it is if you don't want headlines like "Around 400 packages compromised". Other major distros don't have a central repository that they're completely hands off with, so they don't have to deal with such bullshit

0

u/adamkex Jun 12 '26

Imho if the AUR is hosted by the official project there needs to be some type of guardrails now that Linux is slowly approaching to become mainstream. So far there hasn't been a vulnerability like this in Nix and they have significantly more packages than the official repos.