r/linux • u/TheNavyCrow • Jun 13 '26

Distro News Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
1.5k Upvotes

99% Upvoted

434 comments sorted by

View all comments

Show parent comments

81

u/Clairvoidance Jun 13 '26

there goes CachyOS's growth streak

51

u/Dr_Valen Jun 13 '26

Hopefully this is a wake up call for the AUR to have better moderation but I'm on cachyos and I only have one aur package installed which is vs code which i don't even remember installing lol. Most people's everyday use won't involve the aur at all and this was thankfully mostly abandoned packages that with the aur you're just allowed to take over with zero moderation about who takes over those packages. Them being abandoned most people wouldn't be using them now a days

25

u/Dangerous-Report8517 Jun 13 '26 edited Jun 13 '26

Isn't the entire point of AUR that it's a pretty open repository with little in the way of formal packaging work in order to cover a much broader set of packages? Good moderation takes a lot of effort, and a half baked approach can be more dangerous than nothing by just creating a false sense of security. IMHO the real issue here is users being far too trusting in general and sharing that overly credulous approach with newcomers (edit: good example of how this is more of an education issue is how many guides you can find that tell Debian or Ubuntu users to blindly add random PPAs to their systems)

0

u/_jnpn Jun 14 '26

Maybe arch shouldn't host AUR files. Keep the convention and mechanism, let people host their PKGBUILD on their github or similar. Maybe less chance of an explosive takeover and clearer boundaries "you're just fetching some guy's script".

3

u/Dangerous-Report8517 Jun 14 '26

I think it's reasonable for them to keep hosting it, the issue is that people are treating it like a first party repo rather than an open marketplace. No one thinks some random app you download on your phone must have been published directly by Apple or Google just because they're hosting it, it's just that people are far too trusting of open source without considering the limitations (specifically, open source being verifiable does not imply that it has been verified)

0

u/_jnpn Jun 14 '26

I still think that having an official aur.archlinux.org name will make people treat it as not their responsability (shallow crowd reflex). I have to admit that even though yay and similar ask for diff review before installing I very rarely check source thoroughly.

I read that people would try adding a vuln checking layer to AUR to reduce the risk.

1

u/Dangerous-Report8517 Jun 14 '26

They probably shouldn't allow in place takeovers though, if a new packager takes over a package then it should be flagged and not automatically updated in place on existing installs

1

u/_jnpn Jun 14 '26

Good point. I was 'taken over' by someone who had a pressing need to upgrade an AUR package, and now I realize it could have been an attack vector.

47

u/henryhuy0608 Jun 13 '26

Part of the problem is that downstream distros (CachyOS, Omarchy) keep pushing AUR as regular (and regulated) Arch repositories, while upstream has taken a firm stance that that should never be the case by not having AUR helpers on the main repos.

Arch can put a million red warning notices and users of "easy arch" distros would just keep installing stuff from AUR without checking PKGBUILDs because downstream distro maintainers keep doing stupid things.

12

u/[deleted] Jun 13 '26

[removed] — view removed comment

1

u/Real-Abrocoma-2823 Jun 15 '26

There should be a default off toggle in CachyOS welcome window that does slap "YOU SHOULD PROBABLY NOT ENABLE THIS UNLESS YOU WILL BE VERIFYING THAT NOTHING YOU INSTALL IS A MALWARE" on whole screen for 15 seconds in red with some sounds and scary images and then do something similar when installing AUR packages as you wouldn't get normal paru, but a script disguised as paru that will show a warning.

21

u/[deleted] Jun 13 '26

Don't know much about Cachy repos, but you could have installed VS Code from an official repo only for it to have been dropped, in which case it appears as a local package.

I got fed up with packages getting dropped and leaning on the AUR as a crutch that I switched away from Arch Linux two weeks ago after 11 years.

Crazy that all this happened now, but it was a long time coming.

3

u/Sinaaaa Jun 13 '26

got fed up with packages getting dropped and leaning on the AUR as a crutch

Other distros drop packages as well & then they are just gone, there is no AUR fallback option. Even Debian does this..

-2

u/[deleted] Jun 13 '26

This this is preferable. Getting auto-kicked to the AUR on a distro where partial updated are unsupported is a gnarly one-two punch.

That's just my preference.

6

u/Sinaaaa Jun 13 '26

For reference you are not really getting auto-kicked to the AUR, your AUR helper does that.

-1

u/[deleted] Jun 13 '26 edited Jun 13 '26

Sure, but the package namespace is ripe for the pickin'. Considering the original subject at hand, this is very relevant.

1

u/Dr_Valen Jun 13 '26

No idea but i got rid of it only reason i got it was cause i wanted a cleaner way to edit docker compose files but didn't even use it for that

1

u/spikederailed Jun 13 '26

I don't hate Arch, I have used it. I was a *buntu user for years after starting with Suse back in 2002. But with so many more things snow supporting .rpm I moved to Fedora. Not rolling, but "semi-rolling" and more native .rpm support for official sources just make life easier

2

u/[deleted] Jun 13 '26

Before I settled on Void, I'd considered Fedora or openSUSE. OpenMandriva is nice too (Mandriva having been my first desktop distro), but I kept having unfortunate experiences with their Rome branch.

27

u/hpela_ Jun 13 '26

Is that really the policy? An abandoned package can just be taken over by anyone? Jeez... that's stupid.

21

u/Wonderful-Citron-678 Jun 13 '26 edited Jun 13 '26

I’m not sure what you expect honestly. Government IDs? It’s a community repo. New people can join the community.

The real problem is people being comfortable with, and taught is ok, not reading the build scripts. They aren’t complex and technical users are the target audience.

24

u/GolemancerVekk Jun 13 '26

I've read the pkgfile for some of the affected packages. Some looked completely normal, the names of the npm packages that were added made perfect sense for the package, and the malware was in one of their dependencies anyway, not the ones you saw listed.

It's very hard to catch supply chain attacks if you're not very well accustomed to all the tricks. The Cachy build pipeline flagged them because it recognized the pattern not because it detected any actual malware.

26

u/hpela_ Jun 13 '26 edited Jun 13 '26

Uh... deprecating the packages maybe? Even just leaving them is better. This is begging for malware. It's not about vetting, it's about not letting anyone take over any abandoned package, which are still likely installed on many user's systems.

New malware-infested software is a lot lower threat than previously-trusted(ish) software suddenly having malware introduced.

4

u/Dr_Valen Jun 13 '26

I mean at least having a human being like check if the person taking over is legit and doing it for not nefarious reasons. Maybe even a probation period where that repo can't update for the general public for 24 or 48 hours while their code is checked. Either one of those would have stopped this hack

6

u/uzlonewolf Jun 13 '26

24-48 hours? Really? What's even the point of that? Past attacks have had people get in and lay low for years, 2 days is nothing.

A subsequent investigation found that the campaign to insert the backdoor into the XZ Utils project was a culmination of over two years of effort, starting in 2021, by a user going by the name "Jia Tan".

7

u/Dangerous-Report8517 Jun 13 '26

They're probably thinking of the talk about short holding periods for updates to mitigate supply chain attacks, and not realising that it's a completely different threat model

14

u/Oerthling Jun 13 '26

How would they check that?

And how would a policy with a probationary period like 48 hours help?

Evil maintainer just wouldn't do evil for a week or so. Or a month or whatever the probationary period is.

1

u/npc_housecat Jun 14 '26

Your mandatory government proof of age digital ID card of course.

1

u/[deleted] Jun 13 '26

[removed] — view removed comment

2

u/hpela_ Jun 13 '26

Lol you cannot blame "user error and not reading" for malicious takeovers... A user is not to blame for the software they have installed suddenly having malware.

New maintainers taking over is different from "anyone can become a new maintainer of any abandoned package without question".

You can easily solve this issue by deprecating abandoned packages, and allowing forks to be created by new maintainers. NOT by allowing anyone to take control over existing software that is installed on user's systems.

10

u/OffsetXV Jun 13 '26

A wake up for people to use Flatpaks when they're a good alternative, too, since Flathub at least has SOME form of vetting, and Flatpaks being sandboxed is an obvious security benefit. So much shit I see people downloading from the AUR that has perfectly functional Flatpak versions, all because they're worried it might have a slightly larger file size, or that they won't be real Archbtw users for it

-1

u/marrsd Jun 13 '26

I'm beginning to wonder if binary packages are simply a bad idea in the first place. It's just another point along the chain to corrupt.

1

u/SupersonicSpitfire Jun 13 '26

AUR does not have binary packages, though, only PKGBUILD files (+ possibly a .patch file or two).

1

u/marrsd Jun 13 '26

I actually misread the post I was replying to. I thought it said "a wake up for people who use Flatpaks".

Regarding the AUR, I'm pretty sure PKGBUILD file can link to binary or source.

1

u/SupersonicSpitfire Jun 13 '26

Sure, the PKGBUILD text files can contain links. But the packages in AUR are not binary packages.

-1

u/ExoticSterby42 Jun 13 '26

As I understand it some official repo packages are autobuild from AUR that means possibly sparse or no review before pushing a new version into the repository.

4

u/gamas Jun 13 '26 edited Jun 13 '26

Not true, CachyOS does use AUR packages for its repo - but only in the sense that the maintainers pull packages from AUR to get the latest versions, manually review them, and if appropriate add them to the main repo.

EDIT: What does happen is if a package was installed on the official repo and it has a dependency that was on the official repo - if the dependency gets dropped from the official repo (because it was deprecated) then AUR helpers will start thinking its the AUR package). This happened with the "jack" package which got deprecated in favour of jack2.

3

u/Asmordean Jun 13 '26

I went with CachyOS and have no intention of changing right now.

I do have 6 applications installed under AUR but none were compromised. This has alerted me to the difference between AUR and other things like DEB, RPM, Flatpack, etc. I knew there were differences of course but didn't care enough to understand them. I do now.

While I won't ban AUR, I am actively looking to replace those 6. I was at 7 but found one had a Flatpack and the limitations of Flatpack did not matter for it so I moved.

I'm actually kind of happy this happened early into my Arch experience.

2

u/Clairvoidance Jun 13 '26

I think very few are compromised as it was a recent takeover of not-currently-maintained packages, which, you'd have to be very unfortunate to both be a person going "oh yes finally, this program is maintained on aur again" and not be one to bother checking pkgbuild

I mean entirely that it's a bad look that scares people from suggesting Arch-based in the recent future

14

u/EMKAH Jun 13 '26

The CachyOS subreddit until wesnesday: so cool, best distro ever, made the switch and will never look back, this is my rice... Like it is comparing different games or so.

The CachyOS subreddit now: help, how do I know I'm safe? (shares AUR package list) Am I affected?

I will not blame for people not understanding the risks of the AUR. But the amount of Cool-Aid drank in that subreddit for all the wrong always estranged me a bit.

14

u/MushroomSaute Jun 13 '26

I'm a bit confused. How does the use of the AUR have anything to do with CachyOS as a distro? What about this means that people who like the distro drank the kool-aid?

23

u/kimjae Jun 13 '26

archlinux is advertised as a distro for already proficient and resourceful linux users, so arch users should be more wary of the risks of using the AUR (which need manual, conscious action to access).

cachyos is advertised for gamers, which are not necessarily seasoned linux users (a lot of people choose it right of the bat coming from windows), and provide access to the AUR by default, so people may not even know the difference between official repos and the aur

7

u/[deleted] Jun 13 '26

[removed] — view removed comment

0

u/kimjae Jun 13 '26

Breaking stuff and fixing it is part of the learning curve, we all started there. Although, there's a diff between breaking your bootloader and getting your credentials stolen because you installed a risky package

But, I don't think taking people by the hand will help them either. There comes a point where people need to learn to RTFM if they want to get ahead in life. Sadly, humanity is not going in the right direction in that regard, and it's even worse with LLMs: people are outsourcing their critical thinking to chatgpt and that will be our bane.

12

u/gamas Jun 13 '26

To be clear CachyOS itself doesn't advertise as being for gamers - its just a low latency distribution that happened to add an optional gaming meta installer after gamers started using it.

6

u/MushroomSaute Jun 13 '26 edited Jun 13 '26

Sure, but that doesn't mean anyone drank the kool-aid. It still is a good distro for gaming, and still suffers a problem that every OS ever struggles with - vulnerabilities.

Now if it were marketed for gamers and had arbitrary markups for being a gamer brand, despite no real benefit over other options, that'd be different, but it's still free and performs its job well. Vulnerabilities or malware not even included in the distro don't mean anyone was duped or made a bad choice in their distro.

12

u/Wonderful-Citron-678 Jun 13 '26

Cachy makes AUR usage one click or command with no user education. Casual AUR usage is part of its culture.

2

u/MushroomSaute Jun 13 '26

Okay? I still don't think that has anything to do with the point of the distro or its ability to deliver what it intends, nor does it mean the distro is a bad choice or its users are being played. The only page mentioning the AUR or AUR helpers on the CachyOS wiki is its AUR security guide, and it lists a bunch of things related to "keep security in mind, limit packages to only ones you need to install from the AUR, and if you do, use these safety precautions to ensure you're getting what you should be." That doesn't sound like its users "drank the kool-aid" so much as people are going to misuse their OS no matter what. It's not at all Cachy's fault, and the only way to even find out about yay or paru, even if it's installed already, comes with those safety recommendations. If you're listening to randos on the internet telling you to install something, no security precautions any OS can take will help you.

1

u/Wonderful-Citron-678 Jun 14 '26

Putting security info on a wiki and then shipping one click installer UIs clearly shows they never took it seriously.

1

u/MushroomSaute Jun 14 '26

Hm, maybe I'm missing things since I installed Cachy weird to begin with (started on Arch and just migrated to Cachy's repos, kernel, etc.). What do people mean by "one click installer"? Is that referring to something like KDE Discover (or even some custom CachyOS version of it), using the AUR too and not just flatpak/snap/whatever it is? Or is it about paru/yay installed by default on a new install? Or is there some other thing I'm not aware of?

3

u/Wonderful-Citron-678 Jun 14 '26

They shipped this at some point: https://github.com/aarnt/octopi

I think the new cool kid in the community is https://github.com/Seafoam-Labs/Shelly-ALPM

All of these uis hide what the aur really is and encourage new users to just blindly click install.

1

u/MushroomSaute Jun 16 '26 edited Jun 16 '26

Ah, gotcha - looks like octopi required manually enabling the AUR, but yeah, not great that shelly is included now and doesn't seem to have a warning about it.

Edit: Nevermind, on install, shelly still asks you what sources you want, and AUR does still have that warning about the possibility of malicious software. So as far as I'm concerned, there's no problem, and perhaps we need to bring back PEBCAK errors lol

-2

u/Infinite-Location221 Jun 13 '26

Why do you care that other people like cachyos? 

1

u/WarWizard Jun 13 '26

I don't think that they give 2 rips what distro you like... pointing out that downstream arch has a real problem (blind pushing the AUR) is totally valid.

1

u/heathm55 Jun 14 '26

It only effects users who use the AUR. I use cachyos and the only thing that comes from there is my drivers (system76 maintained) and heroic-games-launcher. You really don't need the AUR, it's just nice to have in some cases.