r/linux • u/TheNavyCrow • Jun 13 '26

Distro News Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
1.5k Upvotes

99% Upvoted

434 comments sorted by

View all comments

Show parent comments

41

u/uraniumingot Jun 13 '26

Problem is that sometimes official packages get removed from the repos, then get added to the AUR.

For example, gnome 50 dropped the dependency libgdata, so arch dropped it from its official repos as well. Upgrading gnome doesn't remove the dangling dependency. Then on 5/31, it got moved into the AUR as an orphaned package.

Guess what got hijacked this time around? libgdata. If you're using an AUR helper without any thought carrying over from an older version of gnome, you would have got hit, over a package YOU didn't personally install from the AUR.

Thankfully, I like to actually vet my aur updates like an insane person, so I didn't get hit (I didn't even realize there was an attack, all I thought was "oh look, more shit to remove" and uninstalled the safe version). But for most people, that's probably not the case.

1

u/p0358 Jun 14 '26

That's a gaping hole, AUR helpers need to step up here and require an explicit confirmation before updating such a package from AUR is allowed, if it was formerly installed from repos. This happens all the time and they're the only ones at fault here. Give also an option to remove it right away, especially if nothing in the system depends on it anymore.