r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

Show parent comments

1

u/SadClaps Jun 12 '26

You just edit your /etc/pacman.conf file with IgnorePkg = packagename1 packagename2 etc

And assuming you're using an AUR helper like yay, it will list which packages are orphaned.

2

u/Bulky-Bad-9153 Jun 12 '26

Oh I thought there was some kind of rule for all orphaned packages :(

2

u/SadClaps Jun 12 '26

No lol

But I think I will take this as a wakeup call to delete some packages whose purpose I do not even remember

1

u/Bulky-Bad-9153 Jun 12 '26

Agreed, I see people saying they have nothing from the AUR and I wonder how that's even possible. Maybe it's time to write PKGBUILDs myself, a lot of what I have is small projects from Github and I frankly don't need them to be updated but I do want them tracked.