this post was submitted on 12 Jun 2026
87 points (100.0% liked)

Linux

14743 readers
385 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 3 years ago
MODERATORS
Ategon@programming.dev
anzo@programming.dev
dwraf_of_ignorance@programming.dev
87
Active AUR malicious packages incident (archlinux.org)
submitted 2 months ago by nemeski@mander.xyz to c/linux@programming.dev
27 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 9tr6gyp3@lemmy.world 5 points 2 months ago (1 children)

AUR packages can be sandboxed with many different solutions. Any pckage can be sandboxed really.

[–] defaultusername@lemmy.dbzer0.com 7 points 2 months ago* (last edited 2 months ago) (2 children)

This attack was executed by a script running in the PKGBUILD itself. You didn't have to run the application to be infected since just building it will infect your machine.

[–] 9tr6gyp3@lemmy.world 3 points 2 months ago (1 children)

Yeah, I bet the build process could also be sandboxed, but Im sure its not the default.

[–] defaultusername@lemmy.dbzer0.com 3 points 2 months ago

Sandboxing the build process would be a process. Nix already does it, for example. Many AUR packages don't include a full list of dependencies.

[–] patlefort@lemmy.world 2 points 2 months ago

It also had an install script that will be run as root when the package is installed. Can't sandbox that.