Linux

As an user of the AUR, this is devastating news to me. I am also guilty of accepting updates without reading the latest changes, even if yay asks me if I want to. This is a reminder to everyone to only install from the AUR for absolutely necessary stuff only, and only if you trust the maintainer. And to at least have a look if something suspicious is going in with the recent changes in the package recipe. AND to read in the communities and news.

I don't understand why there still no official announcement as a warning from the Archlinux team at https://archlinux.org/news/ . Is there a different place for security news specifically about the AUR to subscribe to? EDIT: https://archlinux.org/news/active-aur-malicious-packages-incident/ They did it, an official message.

More Than 400

1579

I don't use Arch BTW.

Ahh clearly Arch users didn't RTFM before installing shit. Skill issue.

PS: The above is an invitation to self-care, not an insult.

AUR

At this point, the count stands at 1500+ https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500

Maybe maintenance of packages shouldn't just be handed over to newly created accounts. This is a design flaw on AUR's part. As Linux popularity rises, these types of attacks will just keep growing. There should also be some sort of system where it is easy to verify that the maintainer of the package is also the actual developer. Like brave-bin has brave has the maintainer who are also the creator. Just give a green check mark to them or something.

Wow that’s bad 🫢

There were announcements and security ping in the arch Linux community discord... But I wish they'd be more vocal on this outside discord especially given discords controversy as of late

Update: they finally posted about it in the arch news feed last night... A bit late but better than never. Npm removed the malicious package, but then the bad actors started using bun instead...

As others have proposed, I really think that orphaned packages should require a moderator of the aur to approve the commit and acquisition of an orphaned package. Currently nothing stops someone from spinning up accounts and hijacking these abandoned projects

The AUR is basically just a shortcut for downloading random shit off GitHub.

It gives un-experienced users a false sense of security.

Whelp...I've REALLY loved EndeavourOS for my laptop, especially because I felt I could mess around with stuff, but maybe this is my call to use something like Fedora or a OpenSUSE variant (I love Tumbleweed dearly).

Nothing against the incredible Arch, but I'm deffos that user who does

> yay 
> "Build files exist. Do clean build? N"  
> "View changes? N".

ENTER.

I want to learn, but also I'm a bit of a danger to myself if this malware threat is this broad.

How do I check if a system has been affected most easily? As far as I have seen it's related to the npm package atomic-lockfile, so would that be enough?

npm ls atomic-lockfile

GOTDAMN

(btw)

Least surprising thing ever. Nothing is reviewed or approved, not even proforma

Dang, if only their packages were more up to date maybe this wouldn’t have happened.

the AUR ideally should have a dedicated team of moderators of packages round the clock but archlinux is a community distro, and you really shouldn't trust the AUR implicitly and treat it as literally downloading stuff from the internet through search because that's what it does most of the time.

I do use AUR though, and only one (obs-studio-liberty) is not endorsed by the programs I use from it

I learned 10 years ago not to use aur helpers because they hide the sources. Aurutils + vifm baby!

Maybe someone here can advise. I ran two of the available "checking" scripts to see if I have any packages installed. Both came up with 1 package I have installed. It is gtkimageview, which is on the list.

However, if I look through the pacman.log I see it was installed on 2024-10 and last upgraded 2025-01. It seems to me that suggests I installed it before this all started, so I'm probably not infected?

(hopefully this doesn't read as blaming the victims instead of the attackers but) I personally don't think it's that complicated to read the updates to AUR packages. It's not any more hard than only commenting after reading the links that people post here instead of just the headlines—which we all do, right?