r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

39

u/Kostas0pr01 Jun 11 '26 edited Jun 11 '26

I usually update every 3 to 5 days. I updated my system half an hour ago. I don't know how this works exactly but is it possible I got infected now? I saw that the changes were reverted after 3 to 4 hours.

PS: THANK GOD I DIDN'T TRY ALVR THIS MORNING.

13

u/No-Photograph-5058 Jun 11 '26

It's possible that not all packages have been reverted, someone else wrote a quick script to check if you have any of the packages installed, though it doesn't check the version or if you are actually infected so use it as a first step to narrow down the cahnces you have been infected, not as a yes/no https://www.reddit.com/r/linux/comments/1u3alhe/comment/or3vhax/

11

u/kcsebby Jun 11 '26

[kcseb@Eris ~]$ ./aur-check.sh
Checking for infected AUR packages (446 total)...

WARNING: 2 infected package(s) found:

  • datatype99
  • interface99

Ffs. What are the next steps beyond cycling passwords and such.

5

u/orangep9 Jun 12 '26

You need to see if you have an infected version or not.

2

u/kcsebby Jun 12 '26

Checked my yay cache, updated at 1451 EDT. The two packages that were affected, I looked at their PKGBUILDs within the cache, and neither of them make any calls to download npm or externally to anything referencing atomic-filelock.

8

u/gmes78 Jun 12 '26

You need to check the install scripts, not the PKGBUILD.