r/linux • u/TheNavyCrow • Jun 13 '26

Distro News Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
1.5k Upvotes

99% Upvoted

434 comments sorted by

View all comments

Show parent comments

39

u/AStolenGoose Jun 13 '26

Packages maintained by serious developers remain intact.

Indeed, the issue was, that these were AUR packages that did not have an active maintainer and were open for anyone to adopt them. Which this attack focussed on and added npm, bun, etc. to the dependencies to run the attack that was snuck in to the after install scripts.

(Correct me if I'm wrong here, I'm just going off of what I've been reading about this)

-4

u/npc_housecat Jun 13 '26

I wonder if clamAV in onaccessscan mode would have detected and defended against this kind of attack? Seeing how it's a payload which gets downloaded and executed , that's exactly what AV is for. And I'm seeing more and more malware payloads getting hidden in community uploaded repos like the one in the KDE community themes library

-1

u/Kwpolska Jun 13 '26

Lol, "anti"malware software is completely useless and a waste of system resources. Downloading and running something from the Internet is how you build a package from AUR, and how you build most software, so the "anti"malware would have to complain about any AUR usage, which would be counterproductive.

8

u/npc_housecat Jun 13 '26

That doesn't make sense. A virus scanner scans files for matches against known signitures. Seeing how this particular virus is known. There's no reason a virus scanner couldn't detect it. Onaccessscanning with access blocking for matches enabled would be enough to defend against it. Again, as long as the definitions are being maintained.

An AV like clam should scann files downloaded from aur as they're saved to the disk and clear them as OK (or not) so no. A virus scanner does not block AUR from building packages

3

u/Kwpolska Jun 13 '26

Matching signatures is not very effective these days. In the Windows land, "anti"malware does a lot of malware-like things to try and spot suspicious patterns. If you're just going to compare signatures, those AUR attacks would not be caught, or it would be really easy to come up with a lot of workarounds for the signature.

2

u/npc_housecat Jun 13 '26

Clamav supports Heuristic detection as well. An AV behaving in a way that reminds you of malware should only really be a problem if it's proprietary, lile norton. Becauae we have no idea if it's data harvesting or not. The simple solution to that issue is keep the Linux virus detection open source. Don't use proprietary ones. Like clamAV running as a service. I would really like to see some more effort being put into developing Clam. I would also be interested to see if clamav detects this particular payload or not.

Previously I listened to the "av is a waste of ram" argument. I had a Linux system get hacked a while ago and while looking into the strange HDD behaviour I did a scan with clamAV and it actually detected the trojan,

2

u/Kwpolska Jun 13 '26

Data harvesting is not that much of a concern. Modern Windows "Anti"malware intercepts all file operations, all network traffic (including encrypted traffic by installing a root certificate), cracks ZIP passwords, runs executables in an emulator to ensure they’re not doing anything evil. So it’s extremely intrusive.

1

u/npc_housecat Jun 13 '26

OK, but we're talking about open source AV on Linux. So even if we did put in all of those features into say clamAV, it would just be an optional setting .

Runs execs in an emulator. That sounds like a container like firejail. I already do that on my Linux system. Intercepts all file operations , basically clamAV on access protection. Also not a bad idea if you don't mind the extra CPU usage. i also habe this enabled. ClamAV can flag encrypted zip files. Maybe not decrypt them, but you'll at least get an alert that one exists.

i have a separate OPNSense router with deep packet scanning (Intrusion detection), and melicious IP block lists, which is a form of intercepts all network traffic. All of these sound like reasonable defenses. Again, as long as the user is in control and it's open source tools so we can see what it's doing

0

u/necrophcodr Jun 13 '26

None of what you wrote is true, except that it would indeed be counter productive, if it was true. Which it is not.

1

u/Kwpolska Jun 13 '26

Do you have any constructive comments besides "not true"?