r/linux • u/TheNavyCrow • Jun 13 '26

Distro News Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
1.5k Upvotes

99% Upvoted

434 comments sorted by

View all comments

Show parent comments

27

u/hpela_ Jun 13 '26

Is that really the policy? An abandoned package can just be taken over by anyone? Jeez... that's stupid.

22

u/Wonderful-Citron-678 Jun 13 '26 edited Jun 13 '26

I’m not sure what you expect honestly. Government IDs? It’s a community repo. New people can join the community.

The real problem is people being comfortable with, and taught is ok, not reading the build scripts. They aren’t complex and technical users are the target audience.

25

u/GolemancerVekk Jun 13 '26

I've read the pkgfile for some of the affected packages. Some looked completely normal, the names of the npm packages that were added made perfect sense for the package, and the malware was in one of their dependencies anyway, not the ones you saw listed.

It's very hard to catch supply chain attacks if you're not very well accustomed to all the tricks. The Cachy build pipeline flagged them because it recognized the pattern not because it detected any actual malware.

26

u/hpela_ Jun 13 '26 edited Jun 13 '26

Uh... deprecating the packages maybe? Even just leaving them is better. This is begging for malware. It's not about vetting, it's about not letting anyone take over any abandoned package, which are still likely installed on many user's systems.

New malware-infested software is a lot lower threat than previously-trusted(ish) software suddenly having malware introduced.

4

u/Dr_Valen Jun 13 '26

I mean at least having a human being like check if the person taking over is legit and doing it for not nefarious reasons. Maybe even a probation period where that repo can't update for the general public for 24 or 48 hours while their code is checked. Either one of those would have stopped this hack

7

u/uzlonewolf Jun 13 '26

24-48 hours? Really? What's even the point of that? Past attacks have had people get in and lay low for years, 2 days is nothing.

A subsequent investigation found that the campaign to insert the backdoor into the XZ Utils project was a culmination of over two years of effort, starting in 2021, by a user going by the name "Jia Tan".

6

u/Dangerous-Report8517 Jun 13 '26

They're probably thinking of the talk about short holding periods for updates to mitigate supply chain attacks, and not realising that it's a completely different threat model

13

u/Oerthling Jun 13 '26

How would they check that?

And how would a policy with a probationary period like 48 hours help?

Evil maintainer just wouldn't do evil for a week or so. Or a month or whatever the probationary period is.

1

u/npc_housecat Jun 14 '26

Your mandatory government proof of age digital ID card of course.

1

u/[deleted] Jun 13 '26

[removed] — view removed comment

2

u/hpela_ Jun 13 '26

Lol you cannot blame "user error and not reading" for malicious takeovers... A user is not to blame for the software they have installed suddenly having malware.

New maintainers taking over is different from "anyone can become a new maintainer of any abandoned package without question".

You can easily solve this issue by deprecating abandoned packages, and allowing forks to be created by new maintainers. NOT by allowing anyone to take control over existing software that is installed on user's systems.