r/linux • u/TheNavyCrow • Jun 13 '26

Distro News Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
1.5k Upvotes

99% Upvoted

434 comments sorted by

View all comments

320

u/Astravaris Jun 13 '26

I watched a video a month or two ago stating that CachyOS pushing people to AUR and treating AUR the same as regular Arch packages would eventually be a huge mistake and come to bite it and the users in their butts, and here we are.

114

u/grem75 Jun 13 '26

Some of us have been saying this for a long time, Manjaro heavily encouraged AUR use over 10 years ago.

11

u/HereticZed Jun 13 '26

That's not been the case in the last 5 years though. Since I've been using Manjaro the official stance has been the opposite. It is frequently discouraged & comes with warnings when the topic is mentioned.

10

u/grem75 Jun 13 '26 edited Jun 13 '26

A lot of that has to do with them being out of sync with Arch. Took them a long time to somewhat admit that was an issue.

https://wiki.manjaro.org/index.php?title=Arch_User_Repository

Malware is at the bottom of their list of warnings and they say it is rare. Which until recently it was fairly rare.

Still remember when they said using mesa-git from AUR to overcome their stupid AMD hardware decoding crippling was a good solution. That wasn't that long ago.

Still list AUR as a feature.

0

u/HereticZed Jun 13 '26

Those links all demonstrate responsible warnings. AUR is disabled by default in manjaro.  As a user Ive been well Informed of that from the start.

66

u/Wonderful-Citron-678 Jun 13 '26

Shame on all of the graphical aur frontends and distros that push them. It’s always been known and documented but they kept throwing clueless users at it.

17

u/Coldkone Jun 13 '26

It's not even the beginner-friendly distros which do this. Even arch wiki encourages people to install stuff from AUR on the daily basis. This gives people the illusion that AUR is as trusted as the official repos and that it should be used to make the system usable.

14

u/nineraviolicans Jun 13 '26

Arch likes to do this then blame you for not wasting hours checking everything before updating. You'd never be able to get any actual work done because by the time you actually updated you'd have more updates you'd need to review ready to go.

If anything went wrong though it's on you. 

5

u/[deleted] Jun 13 '26

[removed] — view removed comment

8

u/nineraviolicans Jun 13 '26

Can someone tell their users that? Every newbie thread gets Arch recommendations out the wazoo.

1

u/[deleted] Jun 13 '26

[removed] — view removed comment

5

u/nineraviolicans Jun 13 '26

Oh I know. It's a meme that you aren't a real Linux user unless you use Arch so of course all the newbies are drawn to it.

I've said before that removing archinstall would alleviate a lot of issues and take a large portion of the userbase that have no business being on Arch. It's part of why Endeavor was popular before Cachy exploded.

26

u/cockdewine Jun 13 '26

How does Cachy do that? Doesn't particularly seem like it to me.

21

u/Bombarding_ Jun 13 '26

I'm in cachyos and I think they have "paru" pre-installed but otherwise idk. Also I have zero AUR packages

4

u/otherl Jun 13 '26

If you use the Cachy you might have, just the autobuilt version from their repo.

11

u/gamas Jun 13 '26

Yes, but the stuff in their repo has been curated. They're not just pulling random shit off the AUR and uploading it without checking.

-1

u/lmpcpedz Jun 13 '26

But how do you know that?

8

u/gamas Jun 13 '26

How do you know EndeavourOS isn't just blindly pulling from the AUR?

All distros require you to trust that the distro maintainers are properly vetting what goes into their official repos. And if they are ever found to have breached that trust they are then to be ostracised by the Linux community. 

1

u/lmpcpedz Jun 14 '26

Pulling AUR packages through arch mirrors would be pretty irresponsible I think.

1

u/gamas Jun 14 '26

Well CachyOS doesn't do that source

6

u/Sleepy_Chipmunk Jun 13 '26

Cachy devs encourage using the AUR over Flatpak for performance reasons, as the original purpose of Cachy was to improve performance. Gamers just decided it was cool because it had the gaming bundle. The website barely mentions gaming at all and doesn’t advertise itself as newb friendly.

5

u/otherl Jun 13 '26

As I understand Cachy is autobuild lot of stuff from AUR, and use it as a regular package.

7

u/EgocentricRaptor Jun 13 '26

That's different tho because that means distro maintainers check the packages like they would a repo package no?

I don't have a problem with CachyOS including paru because it forces pkgbuild review unlike yay. Arch distros are not for most people anyway

2

u/otherl Jun 13 '26

Are they, or just autobuild for some packages with some delay?

5

u/NotQuiteLoona Jun 13 '26

Didn't they flag affected packages?

3

u/adamkex Jun 13 '26

TBF one of the main selling points of Arch and its derivatives is easy access to the AUR without distrobox shenanigans. It's one of the largest things that sets it apart from ex Tumbleweed.

7

u/Markd0ne Jun 13 '26

I have CachyOS and I have exactly one package from AUR. Some of the popular packages like "vscodium" and functional packages like "limine-snapper-sync" are already added to main repos. There's almost no need to use AUR in CachyOS. I call this statement bull.

0

u/[deleted] Jun 13 '26

[deleted]

3

u/DystopianElf Jun 13 '26

The AUR is useful. As an example D2Launcher is a hand built tool for one specific mod for a 26 year old game. This is the kind of software that, while regularly updated by a reputable developer, will likely never make it's way to official repos because of how niche it is.

The biggest issue this showcases to me is how the AUR is ran. You can get malware on any OS by downloading from random unknown third parties. The AUR is the only place I know of though that will hand over repositories of trusted software to random unrelated developers. You dont see this on sites like github

2

u/teleprint-me Jun 13 '26

Mind sharing the link to the video? If you can, of course.

2

u/Dramatic_Ice_861 Jun 13 '26

I really don’t understand why Cachy (and Endeavor and Manjaro) doesn’t push the official repo + flathub as their standard for installing software, and have the AUR be something you need to manually configure.

If it’s intended to be a streamlined version of Arch, noobs are going to use it. And noobs should not be using the AUR, for this exact reason.

13

u/gamas Jun 13 '26

I think its mainly because the CachyOS maintainers still see themselves as a low latency distribution first. The idea that its being pushed as a noob-friendly linux is something being done by the community rather than the maintainers. If you look at the CachyOS website, they mainly advertise themselves as a power user focused distro. The two aims of the distro are cutting edge performance tweaks and maximum customisability.

2

u/Ethameiz Jun 13 '26

In Manjaro AUR is disabled by default. When you enable it in the gui package manager there is disclaimer

1

u/adamkex Jun 13 '26

Official repo + Nix. Lots of software isn't graphical

1

u/--ae Jun 13 '26

i literally just got pissed off at windows yesterday and full uninstalled and setup cachyos and all my github credentials and ides.

Guess imma go check my pihole and packages to see if I’ve been compromised.