A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems.
  • Tetsuo@jlai.luEnglish
    89·
    2 months ago

    I hope all the Arch based distros will do a proper post to inform their users on how to cleanup afterwards.

    I’m hoping at least cachyos, the distro I use, will tell me exactly how to check and clean my system.

    I remember that when I installed a few of my AUR package, I was well aware that this repo was pretty much unregulated and that I just have to trust it’s safe. So I made sure to only use AUR as a last resort. But there was warnings on cachyos that were displayed to tell me to be cautious about it so that’s at least a positive.

    • yesman@lemmy.worldEnglish
      84·
      2 months ago

      The article has instructions to do exactly that.

      Users who regularly install AUR packages should take the following steps immediately:

      Run pacman -Qm to list all foreign (AUR) packages installed on your system and cross-reference against the published list of compromised packages

      Audit recent PKGBUILD history for any packages installed between June 10–12, 2026

      Rotate all credentials — browser passwords, SSH keys, API tokens, and cloud access keys — if any flagged package was installed

      Scan for suspicious processes masquerading as kernel threads using tools like rkhunter or chkrootkit

      Consider using AUR helpers with PKGBUILD review prompts enabled by default.

      The Checklist of infected packages

      • Tetsuo@jlai.luEnglish
        29·
        2 months ago

        Ok, but I was expecting something a bit more automated then opening a list of package in kate and comparing it to my list of installed AUR package… Plus it’s 400 package so that’s a lot of things to check and plenty of space to miss one package by manually checking.

        But I get it I’m lazy and just need to script something myself. This is affecting so many people I thought we would have a script to check quickly if you are “infected”.

        Edit : thanks for the numerous script sent as reply ! But I’m all set now, thanks !

        • Eldritch@piefed.worldEnglish
          7·
          2 months ago

          Yeah, Python has been a massive vulnerability for a long while. And the AUR has similar issues. This is only getting widespread coverage now. But it’s always been a risk.

          • HaraldvonBlauzahn@feddit.orgEnglish
            1·
            2 months ago

            Yes, we need a kind of Debian for Python.

            Part of the solution could be the Guix package manager. Part could be the commercial offerings, like Anaconda.

        • CaptDust@sh.itjust.worksEnglish
          3·
          2 months ago

          Well, those are mostly extension libraries, stuff “normally” installed using pip. Arch is kind of unique that they encourage using system aur over pip, npm and other package managers. While it is a big radius, none of the python packages stick out to me, but maybe I just haven’t encountered the popular ones.

          • iocase@lemmy.zipEnglish
            5·
            2 months ago

            The attackers specifically targeted orphaned projects on AUR so it’s no wonder most of those aren’t familiar to us.

          • esc@piefed.socialEnglish
            3·
            2 months ago

            It isn’t really all that unique? Debian does it, el does it, probably almost any popular distro?

        • flying_sheep@lemmy.mlEnglish
          2·
          2 months ago

          Arch usually doesn’t re-package Python packages that aren’t needed for something else, meaning they end up in the AUR. I maintain several there, and when I stop using them I abandon them. I wouldn’t be surprised if some of the ones I used to maintain are on the list

  • misterrabbit@lemmy.worldEnglish
    42·
    2 months ago

    Been saying for years that people need to stop treating the AUR like a repo, when it’s more akin to curl installscript.sh | bash.

    • Cethin@lemmy.zipEnglish
      8·
      2 months ago

      But it is a repo. It’s just an unofficial one. I don’t know how you use it without understanding this. It’s not far from perfect, but it is useful.

      • gergo@lemmy.worldEnglish
        8·
        2 months ago

        the problem is exactly the fact that it is a repo; it introduces a layer of unknown between the dev and the user. and the user will unavoidably “trust” it (especially when it’s listed amongst official repos in e.g. the graphical version of Pamac), without understanding the risks.

  • Cease@mander.xyzEnglish
    23·
    2 months ago

    I think a lot of people are confusing what the AUR actually IS. It is NOT the official package repository used by Archlinux - it’s more like a bunch of community install scripts for stuff that isn’t officially supported yet - for popularity or other reasons.

    So for all those people complaining and saying “debian does it better” it’s very likely that you would not even HAVE a package to install and would have to come up with a build script on your own - the AUR allows you to skip this and instead just verify that the script itself isn’t malicious, which is usually fairly obvious.

    A lot of people here seem to be under the impression that all of this effort should be abstracted for them - but that’s what you chose when you left windows - a system that you control intimately with a necessitation to actually do some upkeep yourself because a giant company isn’t doing it for you.

    In other words. RTFM and stop expecting other people fix all your problems for you, because that’s exactly how windows got to how it currently is.

    • ExLisper@lemmy.curiana.netEnglish
      7·
      2 months ago

      it’s more like a bunch of community install scripts for stuff that isn’t officially supported yet - for popularity or other reasons.

      I’m looking at the list of affected packages and many of them are in official debian repos. Isn’t the issue then that the official Arch repositories don’t have many packages and people have to use less secure sources? That still sounds like an Arch issue to me.

      • flying_sheep@lemmy.mlEnglish
        7·
        2 months ago

        Arch actually has a large amount of official packages. Maybe some of the packages you’re referring to are just slightly renamed or alternate versions?

        It’s possible that in some areas it has fewer packages of course (e.g. Debian might repackage a larger subset of PyPI as Python packages), but I need the AUR for very few things.

      • Billegh@lemmy.worldEnglish
        3·
        2 months ago

        Just because there is an official package doesn’t mean someone can’t make an aur one with the same name, or with common misspelling.

      • HaraldvonBlauzahn@feddit.orgEnglish
        2·
        2 months ago

        Isn’t the issue then that the official Arch repositories don’t have many packages …?

        Not at all. The official Arch distribution has tens of thousands of packages and the user repository / AUR probably more than 100,000 .

        Edit: I looked it up:

        • According to distrowatch.com, the Arch Linux distribution has over 17,000 packges by now
        • Meanwhile, the number of packages in the Arch User Repository is 114,000 .
    • Jjakef96@lemmy.worldEnglish
      2·
      2 months ago

      I haven’t been on my PC that much this week, just Friday night. And our D&D group uses Discord so I needed to make sure it was up to date to ensure it would run. I typically just do a, “sudo pacman -Syu” and that seems to update what I need.

      If that is the only thing I did with the PC during this window, is there any concern?

      • flop_leash_973@lemmy.worldEnglish
        3·
        2 months ago

        Probably not. The article says that most of it seems to have come from orphaned stuff in the AUR that the threat actors took ownership of via the legit process, then modified to pull down malicious NPM packages when someone went to install them.

        So if your Discord package is well maintained you probably have nothing to worry about.

    • proleEnglish
      2·
      2 months ago

      A lot of people here seem to be under the impression that all of this effort should be abstracted for them

      Wouldn’t this just make it harder to detect?

  • lazylemons@lemmy.todayEnglish
    21·
    2 months ago

    I have always been nervous about this type of thing happening with the AUR. Thankfully many packages I used to need the AUR for have since added native versions or made flatpaks. I hope AUR users don’t have too many issues from this!

  • KssioAug@lemmy.dbzer0.comEnglish
    9·
    2 months ago

    I was starting to get too confident in AUR. Thankfully I wasn’t affected. Just replaced all possible AUR packages to their respective Arch and Flatpak alternatives, with exception of very few or from the ones I had no option. But will definitely check before updating them, and will only install AUR packages as a last resort.

    • HaraldvonBlauzahn@feddit.orgEnglish
      3·
      2 months ago

      Have a look into the Guix package manager. It works fine on top of Arch, and Guix has 31,000 packages now. Great for cross-language development and also suitable for early sharing of projects. npm support is a bit weak though, but packages written in Python, Rust, or functional languages are well represented.

      • Jason2357@lemmy.caEnglish
        1·
        2 months ago

        Thats like nix packager, right? Looks interesting to layer on top. Says they are all reproducible builds which is nice.

        • HaraldvonBlauzahn@feddit.orgEnglish
          3·
          2 months ago

          Yes, Guix is initially a clone of Nix and has still remains of shared code (the build daemon).

          Differences:

          • Guix packages are defined in a Scheme dialect called Guile, a nice minimal functional language
          • Guix was created as a GNU project and stresses the importance of free software with strong copyleft
          • strong focus on long-term reproducibility and capability of tracking the sources
          • everything is built from source
          • very good and well organized documentation
  • xploit@lemmy.worldEnglish
    8·
    2 months ago

    Welp if nothing else at least this has helped me to replace jack1 with jack2 (out of my 4 total Aur packages)

  • xthexder@l.sw0.comEnglish
    7·
    2 months ago

    Not even having npm installed as a system package feels like a personal win right now. I’d like to think I would have caught this due to the number of dependencies it would introduce to my system. node_modules seems like it’s been the source of most of the recent CVEs I’m hearing about.

  • malloc@lemmy.worldEnglish
    6·
    2 months ago

    Is this the first time AUR has been compromised to this degree?

    Given how changes are often unvetted, I am surprised this hasn’t occurred before.

      • Ŝan • 𐑖ƨɤ@piefed.zipEnglish
        5·
        2 months ago

        anyone can “adopt” orphaned package on AU

        Þis is þe important point. I vet my AUR installs by checking upstream, but I don’t vet every package for every upgrade. Or, even, most. AUR could have a little more oversight wiþ relatevely little impact. E.g. a cursory initial check and þen an AUR rule preventing anyone from changing þe source repos on an existing package would make a huge difference. AUR is a centralized package list; a simple diff on source preventing inclusion in þe pkglist, and flagging þe package for review, say. Not foolproof, but it’d prevent þe most trivial exploits.

        Frankly, whatever problems GPG may have, AUR is a perfect use case for þe web of trust. Having maintainers have to sign packages would make exploits even harder. Not fookproof, but harder þan “effortless.”

        • northernlights@fedia.io
          5·
          2 months ago

          You may or may not have commented something useful. I don’t know. Your retarded spelling right off the bat makes the whole thing moot.

  • Kazel@lemmy.dbzer0.comEnglish
    6·
    2 months ago

    Look how every motherfucker complains about arch and the aur but not that their distros blindly use it without contributing back and even suggest to blindly trust it. these same people now complain the aur is to complicated. Never go full retard guys

    • Attacker94@lemmy.worldEnglish
      16·
      2 months ago

      Be careful with relying on it though since it has more holes than swiss cheese due in part to lazy devs who request unesecary permissions & the sandbox being slightly flawed from a security perspective.

      • bluGill@fedia.io
        5·
        2 months ago

        A sandbox that has enough protection to be secure also has enough restrictions as to be too annoying to use, and often is useless. Don’t get me wrong, sandboxes can be very good, but only in specific situations. In general you need your applications to be secure without a sandbox.

    • Billegh@lemmy.worldEnglish
      1·
      2 months ago

      It’s a sandbox in the sense that it is a box to keep the sand in one place under normal circumstances. It was never intended to completely prevent sand from being ejected by an unruly child inside of it. Or perfectly keep outside toys from being brought into it if someone tries to do that.

    • caseyweederman@lemmy.caEnglish
      3·
      2 months ago

      I think there was a word missing.
      To respond to what I think you were saying, this event happened in the Arch User Repository, and not the official repositories.
      Arch is very clear that they are not responsible for what goes on in the AUR. For example on https://aur.archlinux.org/ :

      DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.

      The Debian equivalent would be somewhere between extrepo and PPAs.

      • stealth_cookies@lemmy.caEnglish
        9·
        2 months ago

        I think the comment makes sense, if more packages were supported on the main Arch repos there would be less of a need to use the AUR or Flatpaks.

        There are definitely some big gaps on the Arch repos (web browsers in particular) that I would like to see improved.

        • caseyweederman@lemmy.caEnglish
          1·
          2 months ago

          You’re right, but web browsers can be pretty brutal to build and they are for sure never going to add -bin versions.

          • stealth_cookies@lemmy.caEnglish
            4·
            2 months ago

            I don’t understand this argument. Isn’t it better to build once and distribute binaries than to make everyone compile it themselves? The vast majority of AUR packages I use are -bin versions.

            • caseyweederman@lemmy.caEnglish
              2·
              2 months ago

              You don’t get to see the code that way, which is where bad actors thrive. Also it wasn’t compiled for exactly your system.

      • Mwa@thelemmy.clubEnglish
        4·
        2 months ago

        maybe i went offtopic but i was comparing the AUR To Debian’s repos, i see that Debian has more packages in its repos(things like Llama-CPP and Open arena is in debian but arch needs the AUR)
        thats what i meant

  • Ŝan • 𐑖ƨɤ@piefed.zipEnglish
    4·
    2 months ago

    Ha! Infosec has been telling us to update out software frequently because it’s safer. My strategy of bone-idleness and updating only once a monþ or two is looking pr-etty smart.

    • flying_sheep@lemmy.mlEnglish
      1·
      2 months ago

      That’s not how that works.

      • when you use distribution-provided packages, you trust the distribution maintainers
      • when you use the AUR you trust the upstream project and check the PKGBUILD because the maintainer can change

      In some cases, upstream also maintains the AUR package, in which case you can probably trust that it’ll not be abandoned