217
400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers
(cybersecuritynews.com)
Another win for Windows
this post was submitted on 12 Jun 2026
217 points (99.5% liked)
Technology
85355 readers
3599 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
Expecting user to inspect install scripts is retarded. And this is the result.
Been saying for years that people need to stop treating the AUR like a repo, when it's more akin to curl installscript.sh | bash.
So, better to use a safe language, and use
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs/ | sh
(I copied that from https://rust-lang.org/tools/install/ just a second ago....)
Some packages pull files from personal dropbox...
I hope all the Arch based distros will do a proper post to inform their users on how to cleanup afterwards.
I'm hoping at least cachyos, the distro I use, will tell me exactly how to check and clean my system.
I remember that when I installed a few of my AUR package, I was well aware that this repo was pretty much unregulated and that I just have to trust it's safe. So I made sure to only use AUR as a last resort. But there was warnings on cachyos that were displayed to tell me to be cautious about it so that's at least a positive.
The article has instructions to do exactly that.
Users who regularly install AUR packages should take the following steps immediately:
Run pacman -Qm to list all foreign (AUR) packages installed on your system and cross-reference against the published list of compromised packages
Audit recent PKGBUILD history for any packages installed between June 10–12, 2026
Rotate all credentials — browser passwords, SSH keys, API tokens, and cloud access keys — if any flagged package was installed
Scan for suspicious processes masquerading as kernel threads using tools like rkhunter or chkrootkit
Consider using AUR helpers with PKGBUILD review prompts enabled by default.
Ok, but I was expecting something a bit more automated then opening a list of package in kate and comparing it to my list of installed AUR package... Plus it's 400 package so that's a lot of things to check and plenty of space to miss one package by manually checking.
But I get it I'm lazy and just need to script something myself. This is affecting so many people I thought we would have a script to check quickly if you are "infected".
It's at the bottom of the doc:
echo "Checking for infected AUR packages (${#INFECTED_PKGS[@]} total)..."
echo
found=()
for pkg in "${INFECTED_PKGS[@]}"; do
if pacman -Qi "$pkg" &>/dev/null; then
found+=("$pkg")
fi
done
if [[ ${#found[@]} -eq 0 ]]; then
echo "Clean: none of the known infected packages are installed."
else
echo "WARNING: ${#found[@]} infected package(s) found:"
for pkg in "${found[@]}"; do
echo " - $pkg"
done
fi
Not sure why it uses -Qi instead of -Qm since there's no point in scanning pacman packages, but I'm no expert
You could probably find it on aur lmao
It took Arch ~19 years just to get archinstall.
Something tells me there won't be a script.
The link is a script
Arch had curses based installator for a long time, it became unmaintained.
load more comments
(1 replies)
CachyOS community seems to have a detection script, I have not vetted this run at your own discretion.
https://discuss.cachyos.org/t/aur-compromised-400-packages-affected-20260611/31040
I haven't used kate but does it not have some sort of easy search?
ex. pacman -Qm to list AUR packages; should display the 3/4 pkgs you have installed. Then just search in kate for those 3/4 results?
Alternatively cat & grep in the terminal is pretty straight forward.
That is if it's 3/4 pkgs that are from AUR, but if someone has hundreds installed that is a bigger issue on its own.
how many aur packages do you have? Most people i know have like AT MOST 20 or so packages from the aur. Which takes less then 2 mins to manually check against the list.
I'm not home for a few days so I can't check yet.
But I think I have something like 3/4 packages at the most.
But I need to compare that to a 400+ list I'm not sure I agree with you it's that easy to do rigorously.
Not sure I understand - if you only have 3-4 packages you can just search for them specifically in the long list?
Even if you have 50 or 100s of packages, bash makes it pretty doable
comm -12 <(sort -u file1.txt) <(sort -u file2.txt) > common.txt
Should spit out only the packages appearing in both lists (done by memory so may not be 100%)
Do you have anything that will wipe their butt too?
load more comments
(4 replies)
Holy shit it's like all of Python.
Well, those are mostly extension libraries, stuff "normally" installed using pip. Arch is kind of unique that they encourage using system aur over pip, npm and other package managers. While it is a big radius, none of the python packages stick out to me, but maybe I just haven't encountered the popular ones.
It isn't really all that unique? Debian does it, el does it, probably almost any popular distro?
I suppose it's become more common since PEP 668 was introduced, less unique these days.
The attackers specifically targeted orphaned projects on AUR so it's no wonder most of those aren't familiar to us.
Yeah, Python has been a massive vulnerability for a long while. And the AUR has similar issues. This is only getting widespread coverage now. But it's always been a risk.
Welp if nothing else at least this has helped me to replace jack1 with jack1 (out of my 4 total Aur packages)
I have always been nervous about this type of thing happening with the AUR. Thankfully many packages I used to need the AUR for have since added native versions or made flatpaks. I hope AUR users don't have too many issues from this!
flatpaks arn't any safer and with how poor the sandbox is handled by 99% of devs. Hell flatpaks have a new issue every other month. Its almost more often to see a new flatpak problem then aur problem.
Its literally no safer in reality sure on paper its safer but reality has proven that flatpaks just are not some magical fix to this problem.
Hell half the time when flatpaks do have issues they go unaddressed or fixed for months after they are found. While AUR problems get smacked real fucking fast after they are found.
The one positive with flatpak is that it allows for universal deployment. A lot of projects are providing official builds. But you are still relying on them to vet what they put in.
Is this the first time AUR has been compromised to this degree?
Given how changes are often unvetted, I am surprised this hasn’t occurred before.
Is this the first time AUR has been compromised to this degree?
I do believe so, yes. There was couple of cases in last year, but never to this extend. If I understand correctly, reading arch thread, it something to do with the fact that anyone can "adopt" orphaned package on AUR. Which is kinda wild.
anyone can “adopt” orphaned package on AU
Þis is þe important point. I vet my AUR installs by checking upstream, but I don't vet every package for every upgrade. Or, even, most. AUR could have a little more oversight wiþ relatevely little impact. E.g. a cursory initial check and þen an AUR rule preventing anyone from changing þe source repos on an existing package would make a huge difference. AUR is a centralized package list; a simple diff on source preventing inclusion in þe pkglist, and flagging þe package for review, say. Not foolproof, but it'd prevent þe most trivial exploits.
Frankly, whatever problems GPG may have, AUR is a perfect use case for þe web of trust. Having maintainers have to sign packages would make exploits even harder. Not fookproof, but harder þan "effortless."
A lot of the AUR is just build scripts for GitHub repos ...
Or dropbox
Ha! Infosec has been telling us to update out software frequently because it's safer. My strategy of bone-idleness and updating only once a monþ or two is looking pr-etty smart.
I wish Arch packages as much in their repos as Debian.
I think there was a word missing.
To respond to what I think you were saying, this event happened in the Arch User Repository, and not the official repositories.
Arch is very clear that they are not responsible for what goes on in the AUR. For example on https://aur.archlinux.org/ :
The Debian equivalent would be somewhere between extrepo and PPAs.
I think the comment makes sense, if more packages were supported on the main Arch repos there would be less of a need to use the AUR or Flatpaks.
There are definitely some big gaps on the Arch repos (web browsers in particular) that I would like to see improved.
load more comments
(2 replies)
maybe i went offtopic but i was comparing the AUR To Debian's repos, i see that Debian has more packages in its repos(things like Llama-CPP and Open arena is in debian but arch needs the AUR)
thats what i meant
view more: next ›