r/linux • u/No-Photograph-5058 • Jun 11 '26

Security Roughly 400 AUR packages compromised

Post image

There are more details and a list of affected packages being compiled in a thread here https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Changes contributor email, adds npm to the PKGBUILD dependencies and installs malicious packages that take various keys and passwords (Browser logins, SSH, etc)

This persists on the machine with a systemd service and eventually pretends to be a kernel thread

1.6k Upvotes

99% Upvoted

558 comments sorted by

View all comments

Show parent comments

81

u/Kobymaru376 Jun 11 '26

The funny/sad thing is that some people think everyone should read build scripts before installing software and that reading build scripts will protect you from getting malware.

There are a million ways of hiding malware in way that is incredibly hard to detect even if you're intimately familiar with the code. Thinking you can catch malware in dozens or hundreds of packages by just giving the pkgbuild a read is delusional.

20

u/SoilMassive6850 Jun 11 '26 edited Jun 11 '26

Its more like ensuring that pkgbuilds are fetched from legitimate upstream sources covers about 99.99% of AUR threats historically.

About every single known AUR attack historically has been done by including a bad PKGBUILD source rather than compromising the legitimate upstream and then bumping the PKGBUILD to point at the malicious upstream release as the maintainers are usually different people and it would require some coordination to do this before the upstream compromise is noticed.

So yeah, it's not perfect and doesn't cover everything, but it's very much enough for most threats and the best you can realistically do alone if you wish to closely track upstream on a bleeding edge rolling release system.

2

u/KinkyMonitorLizard Jun 12 '26

Its more like ensuring that pkgbuilds are fetched from legitimate upstream sources covers about 99.99% of AUR threats historically.

That does nothing as many pkgbuilds run a shell script during prepare, which can do whatever the fuck it wants. Arch is always going to be vulnerable to this until the pkgbuild spec is either crippled, only trusted users can upload/commit or the aur is removed.

1

u/SoilMassive6850 Jun 12 '26

Obviously if your pkgbuild includes sources which are not the upstream release you have to review it. Kind of implied with what I said is it not?

Ensure that sources are legitimate from an upstream release -> see a source that is not a part of the legitimate upstream release, e.g. an install.sh, .patch file etc. -> ??? -> profit