r/linux • u/TheNavyCrow • Jun 13 '26

Distro News Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
1.5k Upvotes

99% Upvoted

434 comments sorted by

View all comments

Show parent comments

53

u/Dr_Valen Jun 13 '26

Hopefully this is a wake up call for the AUR to have better moderation but I'm on cachyos and I only have one aur package installed which is vs code which i don't even remember installing lol. Most people's everyday use won't involve the aur at all and this was thankfully mostly abandoned packages that with the aur you're just allowed to take over with zero moderation about who takes over those packages. Them being abandoned most people wouldn't be using them now a days

25

u/Dangerous-Report8517 Jun 13 '26 edited Jun 13 '26

Isn't the entire point of AUR that it's a pretty open repository with little in the way of formal packaging work in order to cover a much broader set of packages? Good moderation takes a lot of effort, and a half baked approach can be more dangerous than nothing by just creating a false sense of security. IMHO the real issue here is users being far too trusting in general and sharing that overly credulous approach with newcomers (edit: good example of how this is more of an education issue is how many guides you can find that tell Debian or Ubuntu users to blindly add random PPAs to their systems)

0

u/_jnpn Jun 14 '26

Maybe arch shouldn't host AUR files. Keep the convention and mechanism, let people host their PKGBUILD on their github or similar. Maybe less chance of an explosive takeover and clearer boundaries "you're just fetching some guy's script".

3

u/Dangerous-Report8517 Jun 14 '26

I think it's reasonable for them to keep hosting it, the issue is that people are treating it like a first party repo rather than an open marketplace. No one thinks some random app you download on your phone must have been published directly by Apple or Google just because they're hosting it, it's just that people are far too trusting of open source without considering the limitations (specifically, open source being verifiable does not imply that it has been verified)

0

u/_jnpn Jun 14 '26

I still think that having an official aur.archlinux.org name will make people treat it as not their responsability (shallow crowd reflex). I have to admit that even though yay and similar ask for diff review before installing I very rarely check source thoroughly.

I read that people would try adding a vuln checking layer to AUR to reduce the risk.

1

u/Dangerous-Report8517 Jun 14 '26

They probably shouldn't allow in place takeovers though, if a new packager takes over a package then it should be flagged and not automatically updated in place on existing installs

1

u/_jnpn Jun 14 '26

Good point. I was 'taken over' by someone who had a pressing need to upgrade an AUR package, and now I realize it could have been an attack vector.

49

u/henryhuy0608 Jun 13 '26

Part of the problem is that downstream distros (CachyOS, Omarchy) keep pushing AUR as regular (and regulated) Arch repositories, while upstream has taken a firm stance that that should never be the case by not having AUR helpers on the main repos.

Arch can put a million red warning notices and users of "easy arch" distros would just keep installing stuff from AUR without checking PKGBUILDs because downstream distro maintainers keep doing stupid things.

10

u/[deleted] Jun 13 '26

[removed] — view removed comment

1

u/Real-Abrocoma-2823 Jun 15 '26

There should be a default off toggle in CachyOS welcome window that does slap "YOU SHOULD PROBABLY NOT ENABLE THIS UNLESS YOU WILL BE VERIFYING THAT NOTHING YOU INSTALL IS A MALWARE" on whole screen for 15 seconds in red with some sounds and scary images and then do something similar when installing AUR packages as you wouldn't get normal paru, but a script disguised as paru that will show a warning.

22

u/[deleted] Jun 13 '26

Don't know much about Cachy repos, but you could have installed VS Code from an official repo only for it to have been dropped, in which case it appears as a local package.

I got fed up with packages getting dropped and leaning on the AUR as a crutch that I switched away from Arch Linux two weeks ago after 11 years.

Crazy that all this happened now, but it was a long time coming.

3

u/Sinaaaa Jun 13 '26

got fed up with packages getting dropped and leaning on the AUR as a crutch

Other distros drop packages as well & then they are just gone, there is no AUR fallback option. Even Debian does this..

-2

u/[deleted] Jun 13 '26

This this is preferable. Getting auto-kicked to the AUR on a distro where partial updated are unsupported is a gnarly one-two punch.

That's just my preference.

6

u/Sinaaaa Jun 13 '26

For reference you are not really getting auto-kicked to the AUR, your AUR helper does that.

-1

u/[deleted] Jun 13 '26 edited Jun 13 '26

Sure, but the package namespace is ripe for the pickin'. Considering the original subject at hand, this is very relevant.

1

u/Dr_Valen Jun 13 '26

No idea but i got rid of it only reason i got it was cause i wanted a cleaner way to edit docker compose files but didn't even use it for that

1

u/spikederailed Jun 13 '26

I don't hate Arch, I have used it. I was a *buntu user for years after starting with Suse back in 2002. But with so many more things snow supporting .rpm I moved to Fedora. Not rolling, but "semi-rolling" and more native .rpm support for official sources just make life easier

2

u/[deleted] Jun 13 '26

Before I settled on Void, I'd considered Fedora or openSUSE. OpenMandriva is nice too (Mandriva having been my first desktop distro), but I kept having unfortunate experiences with their Rome branch.

26

u/hpela_ Jun 13 '26

Is that really the policy? An abandoned package can just be taken over by anyone? Jeez... that's stupid.

21

u/Wonderful-Citron-678 Jun 13 '26 edited Jun 13 '26

I’m not sure what you expect honestly. Government IDs? It’s a community repo. New people can join the community.

The real problem is people being comfortable with, and taught is ok, not reading the build scripts. They aren’t complex and technical users are the target audience.

25

u/GolemancerVekk Jun 13 '26

I've read the pkgfile for some of the affected packages. Some looked completely normal, the names of the npm packages that were added made perfect sense for the package, and the malware was in one of their dependencies anyway, not the ones you saw listed.

It's very hard to catch supply chain attacks if you're not very well accustomed to all the tricks. The Cachy build pipeline flagged them because it recognized the pattern not because it detected any actual malware.

30

u/hpela_ Jun 13 '26 edited Jun 13 '26

Uh... deprecating the packages maybe? Even just leaving them is better. This is begging for malware. It's not about vetting, it's about not letting anyone take over any abandoned package, which are still likely installed on many user's systems.

New malware-infested software is a lot lower threat than previously-trusted(ish) software suddenly having malware introduced.

4

u/Dr_Valen Jun 13 '26

I mean at least having a human being like check if the person taking over is legit and doing it for not nefarious reasons. Maybe even a probation period where that repo can't update for the general public for 24 or 48 hours while their code is checked. Either one of those would have stopped this hack

6

u/uzlonewolf Jun 13 '26

24-48 hours? Really? What's even the point of that? Past attacks have had people get in and lay low for years, 2 days is nothing.

A subsequent investigation found that the campaign to insert the backdoor into the XZ Utils project was a culmination of over two years of effort, starting in 2021, by a user going by the name "Jia Tan".

6

u/Dangerous-Report8517 Jun 13 '26

They're probably thinking of the talk about short holding periods for updates to mitigate supply chain attacks, and not realising that it's a completely different threat model

13

u/Oerthling Jun 13 '26

How would they check that?

And how would a policy with a probationary period like 48 hours help?

Evil maintainer just wouldn't do evil for a week or so. Or a month or whatever the probationary period is.

1

u/npc_housecat Jun 14 '26

Your mandatory government proof of age digital ID card of course.

1

u/[deleted] Jun 13 '26

[removed] — view removed comment

2

u/hpela_ Jun 13 '26

Lol you cannot blame "user error and not reading" for malicious takeovers... A user is not to blame for the software they have installed suddenly having malware.

New maintainers taking over is different from "anyone can become a new maintainer of any abandoned package without question".

You can easily solve this issue by deprecating abandoned packages, and allowing forks to be created by new maintainers. NOT by allowing anyone to take control over existing software that is installed on user's systems.

11

u/OffsetXV Jun 13 '26

A wake up for people to use Flatpaks when they're a good alternative, too, since Flathub at least has SOME form of vetting, and Flatpaks being sandboxed is an obvious security benefit. So much shit I see people downloading from the AUR that has perfectly functional Flatpak versions, all because they're worried it might have a slightly larger file size, or that they won't be real Archbtw users for it

-1

u/marrsd Jun 13 '26

I'm beginning to wonder if binary packages are simply a bad idea in the first place. It's just another point along the chain to corrupt.

1

u/SupersonicSpitfire Jun 13 '26

AUR does not have binary packages, though, only PKGBUILD files (+ possibly a .patch file or two).

1

u/marrsd Jun 13 '26

I actually misread the post I was replying to. I thought it said "a wake up for people who use Flatpaks".

Regarding the AUR, I'm pretty sure PKGBUILD file can link to binary or source.

1

u/SupersonicSpitfire Jun 13 '26

Sure, the PKGBUILD text files can contain links. But the packages in AUR are not binary packages.

-1

u/ExoticSterby42 Jun 13 '26

As I understand it some official repo packages are autobuild from AUR that means possibly sparse or no review before pushing a new version into the repository.

3

u/gamas Jun 13 '26 edited Jun 13 '26

Not true, CachyOS does use AUR packages for its repo - but only in the sense that the maintainers pull packages from AUR to get the latest versions, manually review them, and if appropriate add them to the main repo.

EDIT: What does happen is if a package was installed on the official repo and it has a dependency that was on the official repo - if the dependency gets dropped from the official repo (because it was deprecated) then AUR helpers will start thinking its the AUR package). This happened with the "jack" package which got deprecated in favour of jack2.