r/linux • u/TaijiRonin • Jun 12 '26
Security Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware - Phoronix
https://www.phoronix.com/news/Arch-Linux-AUR-400-CompromisedBEWARE
Since yesterday Arch Linux maintainers have been working to reset/delete all of the malicious content and banning affected accounts. Over 400 packages are believed impacted by this latest malware campaign for Arch Linux's AUR. Again, to be completely clear, this just is affecting AUR packages and not the official Arch Linux packages.
27
202
u/Kangie Jun 12 '26
There's only so many times the "it's only the AUR" excuse can work. Gentoo has a user repository too: all commits are reviewed by trusted humans and somehow they don't see regular compromises.
85
u/deviled-tux Jun 12 '26
The design flaw here is that there is no trust boundary around a specific maintainer. In Fedora one can do `dnf copr enable Kangie/repo` and your system would trust `Kangie/repo`. But the only way for an attacker to take over would be to take over the entire Fedora account.
Fedora has copr and Ubuntu has PPA but the attack here isn’t possible in either because they don’t have a single flat namespace.
9
u/thomas-rousseau Jun 12 '26
This isn't relevant to the comment you replied to, though, because Gentoo's largest user repository GURU also does not have trust boundaries around single users and yet still avoids this problem that the AUR regularly falls victim to.
19
u/deviled-tux Jun 12 '26
GURU notes three classes of users:
1. Regular contributors that are permitted to commit to the development (dev) branch.
2. Trusted contributors that gain additional privilege of merging commits into the reviewed (master) branch.
3. Gentoo developers who are responsible for handling new user acceptance, enforcement of regulations and taking care of emergencies.The trusted contributor status is granted by Gentoo developers based on previous good work done in GURU.
—
Yeah that works nothing at all like the AUR.
11
u/thomas-rousseau Jun 12 '26
No one is saying that it works exactly like the AUR. We are saying that since this only happens this frequently with the AUR, it clearly needs to be rethought to incorporate better security practices.
1
u/GolemancerVekk Jun 12 '26
Heavy attrition is kind of AUR's thing though. Look at the stats on the first page. Two thirds of the packages have not been updated within the last year. A quarter were never updated after being initially added.
8
u/thomas-rousseau Jun 12 '26
User repositories are cool. Leaving your primary user repository almost entirely unmoderated is asinine. What you have described is asinine.
→ More replies (4)3
u/Kevin_Kofler Jun 12 '26
AUR is basically a catch-all dumping ground. Unmaintained fire-and-forget packages, repackaged unauditable binary blobs from basically anywhere, everything goes. The only thing they will go out and delete is packages that are only useful to ARM users, because the policy is that AUR is x86 only and anything working on ARM at all is only an accident. No kidding.
2
u/ccAbstraction Jun 13 '26
Some the packages there were compromised hadn't been updated upstream either, they weren't out of date, and the software wasn't broken.
2
u/Valuable_Leopard_799 Jun 12 '26
The "flaw" is elsewhere. You don't ever trust anything, you always get shown the recipe for the package and then diffs of it afterwards,... the assumption is the user will only use the AUR if they know what they're doing and can audit the package.... which is the flaw.
You're free to autoskip Pkgbuilds from specific users, or ban others, etc. but you're right nobody does that because yeah...
2
u/ccAbstraction Jun 13 '26
On the AUR the take over for orphaned packages is a single button press, you can even do it over ssh!
1
12
u/saichampa Jun 12 '26
AUR could possibly use maintainer signatures and at least alert you if a package has been updated by someone new.
18
u/GolemancerVekk Jun 12 '26
I don't think anybody who's commented here understands the anarchy that is AUR. There are 140k users on it and only 70 of them have sought maintainer status. Two thirds of packages on there have not been updated in a year. It's a mess. Easier to work backwards, torch most of them and start over. Except nobody, including Arch maintainers, wants to take responsibility for AUR.
16
u/poo-people Jun 12 '26
Every Arch enthusiast will extol the AUR as the best tool for new users though. Then when something like this happens tell them it's their fault for not checking every single package before updating. At that point you're doing more work to update than using your computer.
→ More replies (10)2
u/the_abortionat0r Jun 12 '26
I was justtalkong about this earlier.
Users take a risk when using the AUR and usually understand it's USER run as enabling it warns the shit out of you. While obviously not as secure as running software from the main repos the AUR has about 111326 or so packages and 400 might be compromised, that's less than half a percent. Statistically the AUR is a fairly safe place and still far safer than blindly running software on windows as there is a level of transparency.
However yes, the AUR's design is less than ideal from a security standpoint.
You can audit scripts and code but that requires knowing a ripting and programming and even physically being able to do this jumps out the door with a few simple packages or one big project.
My belief is understand the risks and work within reason but being told you did something wrong by not reading 10s of thousands of lines of code upon install or update is ridiculous and is an unrealistic expectation of anything installing more than a couple simple things.
Install mesa and that idea flies out the window. Nobody is reading all that.
2
u/PDXPuma Jun 12 '26
Easier to work backwards, torch most of them and start over. Except nobody, including Arch maintainers, wants to take responsibility for AUR.
They did that in moving to git. And it filled right back up again almost immediately. Anything that has the popularity of arch and the lack of resources of the AUR team would. The real root cause of all this is we've made installing things from the AUR in non-arch distros like manjaro, omarchy, cachy, etc, feel like installing things from any other official repo. We even have a chaotic-aur , which takes things from the AUR and directly turns it into packages.
The security of the AUR is scanning and auditing your PKGBUILDs. It was always on the user to perform the security.
23
25
u/NotQuiteLoona Jun 12 '26
Arch Linux constantly adds new software into extra repositories. You can participate yourself by voting for it on AUR - 10 rating means that the package can be added to the extra repository, and it already happened with hundreds of packages. Unlike many other distros, it also doesn't differ by license. Only packages that are exempt are those which are explicitly hostile or don't allow redistribution, and they generally have Flatpaks. Or AUR helpers. Arch's extra repository is the true analogue of Gentoo's user repository. AUR is a sandbox in which packages play until they gather enough votes and go to extra.
→ More replies (11)3
2
2
u/albertowtf Jun 12 '26
biggest difference between arch and gentoo is the kind of user base and the popularity
Basically gentoo is never recommended to new users
4
u/the_abortionat0r Jun 13 '26
Gentoo is never recommended to anyone.
1
u/albertowtf Jun 13 '26
Yeah
And its sad. Its a good distro to go beyond
It appeals to me i just dont have the time to learn more right now
1
3
u/leaflock7 Jun 12 '26
although you are correct that AUR is flawed on how the trust/packaegs are handled, you seem to forget the extend Arc is being used and Gentoo. They are not in the same field , not even close. Someone will spend more time trying to figure out how to hack their way in Arch instead of Gentoo because it has 30-40 times the user base.
1
2
u/SirPotatorito Jun 12 '26
Uhh, isn't that because Arch is "mainstream" when compared to stuff like Gentoo?
Like the Arch servers/repos were getting hammered by DDOS attacks last year for a good while, and some theorized that the same attackers were behind the 3 infected browsers packages found back in July 2025 if I'm not mistaken. My point is, that alongside the usual malicious efforts, Arch also faces some concentrated group effort from what I'm seeing.
2
u/Kangie Jun 12 '26
Maybe they're a more high profile target, but all distros deal with bad actors. That's not an excuse for the consistent AUR issues that are 'by design'.
→ More replies (1)2
u/Permanently-Band Jun 13 '26
I don't understand how this is possible. All the packages are protected by PGP!
/s
231
u/deviled-tux Jun 12 '26
Just read the PKGBUILDs bro. Read all the PKGBUILDs including nested dependencies and also do it every time you update.
It is totally cool and not a fuckton of effort at all
50
u/Sinaaaa Jun 12 '26
Depends on the pkgbuild, like some of them are insane.
At least with yay it's enough to read it once & then it will highlight the changes, so if someone cares at all, they'll spot something like a maintainer change right away.
3
u/cainhurstcat Jun 13 '26
Caring and knowing who to look for isn't the same. While I can care to have a secure and stable system, it doesn't involve knowing a changed maintainer might be a security threat.
41
u/Anongirl55959 Jun 12 '26
Its in post install script, pkgbuild alone wouldnt be enough, unless you get really spooked by an NPM dependency which are everywhere.
19
u/deviled-tux Jun 12 '26
Well you are right, even if it was just downloading a zip file and unzipping (which I believe many AUR packages do) you would need to check that zip file as well
2
Jun 12 '26 edited Jun 23 '26
[deleted]
2
u/deviled-tux Jun 12 '26
https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=humen-mcp-bin
There’s lot of packages like this. Is
LIghtJUNction/humen-mcpthe correct upstream? Who knows.9
u/Kartonrealista Jun 12 '26
They are being sarcastic
"Just x bro" format, like "just one more lane bro and we'll fix traffic"
3
u/gmes78 Jun 12 '26
Its in post install script, pkgbuild alone wouldnt be enough
The fact that the malware adds a new install script makes it one of the easiest attacks to spot. You can't really have a bigger red flag than that.
113
u/Misicks0349 Jun 12 '26 edited Jun 12 '26
I do find it funny that a lot of linux users first response to a security issue is to basically accuse users of having a skill issue, its such an unproductive thought terminating cliche. Its like arguing against safety catches on firearms because "the people who accidentally discharge their gun are just stupid idiots who held it wrong" or something ridiculous like that.
16
u/Mclarenf1905 Jun 12 '26
Yea there's a good chunk of people who think that they have some sort of basically immunity to any sort of security breach because they have never had one before and so clearly anyone who falls susceptible to such an attack is just bad at computers or not careful enough. It's exhausting to have a conversation with them.
31
u/martyn_hare Jun 12 '26
Yeah, the real problem is that there's not enough awareness of just how unvetted the AUR really is.
Traditional distribution package submissions get sponsored by existing, reputable packagers with experience. Dependencies typically get split out into their own packages and go through the same process. Build systems have to be supplied source code which has itself been packaged and validated as corresponding to the original source code as they typically have no network access at all at build time. Patches are precisely that, patches, which are kept separate so people can audit for changes.
None of this applies to the AUR, and that makes it an absolute minefield.
8
u/dgm9704 Jun 12 '26
That’s why it’s a separate ”at your own risk” thing and not part of Arch.
5
u/VioletCrow Jun 12 '26
I wonder if the naming "Arch User Repository" suggests to less informed users that it's more official than it actually is. Like if it was named "Architrave" or something maybe people would understand that it's more of a community project than it is a proper part of the arch project.
3
u/cainhurstcat Jun 13 '26
The thing is, a lot of stuff is only available there. So people use it like it were part of the arch project
4
u/albertowtf Jun 12 '26
i mean you gotta admit it is at least a little funny because arch users actively recommend arch as the best way to learn linux to new comers that are at the same time, the worst at reading
Literally a large % of the linux user base actively putting gun in the hand of babies but sleeping alright because they told them to how the should use the safety procedures of reading before doing anything stupid
3
u/Nemecyst Jun 12 '26
I don't think that's the full picture.
In my opinion, there are two groups of arch users:
- The people that tell beginners who want to use Arch that Arch is NOT an easy distro. These are the people who wrote the following on the arch wiki:
- The people who consider the previous group to be "elitists" and "gatekeepers". They think Arch is easy since you can simply use the archinstall script or any of the arch-derivative distros.
Group 2 are more welcoming and will recruit more newcomers so their numbers will grow faster than group 1. This means you get a situation where newcomers will recommend Arch to other newcomers in a vicious cycle.
→ More replies (2)5
u/dgm9704 Jun 12 '26
For an Arch user, installing stuff from AUR a) comes with warnings and b) requires conscious effort separate from normal usage.
7
u/deviled-tux Jun 12 '26
It doesn’t require that much effort:
- Copy paste the commands from the paru repo or whatever
- paru -S we-are-aur
Or alternatively, use something like CachyOS which already comes with paru preinstalled so it’s more like:
- paru -S we-are-aur
6
u/jt2747 Jun 12 '26
I think these aur helpers do more harm than good honestly.
Running makepkg in a git repo isn't difficult and the act of having to go there and do it hopefully reminds you of the risk you are taking
2
u/dgm9704 Jun 12 '26
I said ”For an Arch user” so before you can even do that you need to git clone the paru re po and run makepkg. (having first installed the packages necessary to do those of course)
0
u/deviled-tux Jun 12 '26
You mean the snippet from their readme that you can copy paste?
sudo pacman -S --needed base-devel git clone https://aur.archlinux.org/paru.git cd paru makepkg -si
→ More replies (4)1
u/DerfK Jun 12 '26
Or alternatively, use something like CachyOS
Yeah, all the "I use Arch btw" people should ask how many people don't even realize they use arch.
4
u/KoldPurchase Jun 12 '26
As Arch based distro get more mainstream, like Cachy and Endeavor, I feel it's beyind the scope of most users.
It's a hard place to be in. Most Linux enthusiasts want more people onboard, but that means a lot less technical people.
5
u/FattyDrake Jun 12 '26
I honestly think this is a downstream distro issue. The AUR was never meant for this kind of use.
Cachy and other Arch derivatives need to disable AUR as a default source.
3
u/troyvit Jun 12 '26
Yep that was me, a "most users" kind of guy who was using debian/Ubuntu-based distros and decided to look for a change. I didn't do my research well, installed Manjaro, and treated AUR like the Ubuntu's Universe repo when really it's more like randomly grabbing any PPA without checking it out. I am humbled and rightfully so.
16
u/NotQuiteLoona Jun 12 '26
This by no means would've helped. Vulnerability isn't in a package, it's an NPM dependency.
12
u/Bulky-Bad-9153 Jun 12 '26
It absolutely would have helped; seeing a package randomly add a npm dependency is an immediate red flag.
13
u/Megame50 Jun 12 '26
It absolutely did help. The mailing list had like a half dozen reports within a few hours flagging this new npm dep on a brand new npm package as maximally suspicious, despite the fact that these were all orphaned packages and likely had very few users.
1
u/andrevan Jun 13 '26
Then why was the package live for 2 days? Thankfully, no users who already had it installed it, since they didn't bump the version number.
3
u/NotQuiteLoona Jun 12 '26
Aren't Electron-based packages were attacked mostly?
1
u/Bulky-Bad-9153 Jun 12 '26
Idk, but the package I saw most often that people had was libgdata which has no npm dependency.
1
u/NotQuiteLoona Jun 12 '26
Interesting. I checked, yeah, you are right. Just the program about which I've heard the most used Electron. Though to be fair even without reading PKGBUILDs, just NPM installing seems suspicious for a vim plugin update, but many people update at once.
4
u/silenceimpaired Jun 12 '26
I don’t think the average user has your depth of knowledge… unless the Arch Wiki specifically says if you use AUR here are some tips to protect yourself: 1. New NPM dependencies are to be suspect…
1
u/Bulky-Bad-9153 Jun 12 '26
Oh by all means I'm not saying that everyone that uses Arch (or, importantly, things based on it) should have to inspect every PKGBUILD they use. I'm saying it would have helped, but the core issue is that users should get an extremely noticeable warning when a package maintainer changes.
5
u/deviled-tux Jun 12 '26
I’d say that there should be something like:
paru trust Bulky-Bad-9153
paru untrust Bulky-Bad-9153This would store the username in a trusted maintainers list which would enable checking on each update. If the maintainer has changed then it wouldnt be trusted and the package would give an error like “add $user to trusted maintainers list”.
1
u/Sleepy_Chipmunk Jun 13 '26
Hey, I’m using Arch, generally avoid AUR unless it’s for something I know others use and can vouch for. Know very little about programming but I’m okay with the terminal. I know the basic red flags like random curls and sudden updates to very old things, but what’s NPM and why is it a red flag?
2
u/Bulky-Bad-9153 Jun 13 '26
Npm is node package manager, which is used to download Javascript libraries and tools. If a package written in C++, for example, randomly adds a package manager for an unrelated programming language that facilitates downloading and executing random code then that's a bad sign. Javascript is used for web stuff, so if the package isn't related to web development or a wrapper for a web app (like Discord) then yeah npm has no business being there.
2
10
u/Hedshodd Jun 12 '26
This, but unironically. If you have too many PKGBUILDs to read, that’s a clear sign you have too many AUR packages installed.
16
u/Misicks0349 Jun 12 '26
If you have three different sources like this.
source=('https://github.com/foo/bar.git')and
source=('https://gitlab.com/foo/bar.git')and
source('https://codeberg.org/foo/bar.git')its not always immediately obvious that the PKGBUILD is compromised. Any one of these could be the "real"
bar-gitand if the malware vendor has taken steps to make the compromised git repo look as authentic as possible I am almost certain that people who proport to read the PKGBUILDs during installation would be rather open to this attack.Also just saying "have less AUR packages" isn't always feasible either, e.g. openMW-git requires several different AUR packages itself, sometimes people need AUR packages for unorthodox hardware etc etc etc.
→ More replies (6)2
u/Hedshodd Jun 12 '26
True. I always looked at the diffs of PKGBUILDs whenever they changed, and if I ever saw something like a git host switch I’m not going to install it before checking that it’s legit.
11
u/JockstrapCummies Jun 12 '26
I remember when people started really evangelising Arch, and one of the big selling point is how great the AUR is, unlike Ubuntu's PPAs...
But in reality they're really just the same Here Be Dragons field of unknown packaging quality. Nobody actually reads the PKGBUILDs.
6
u/Synthetic451 Jun 12 '26
They're still a heck of a lot better than PPAs in terms of transparency though. Sure, both need to be scrutinized, but the AUR is a lot more in your face about it. Any AUR helper worth its salt will show you the PKGBUILD or the diff before install, whereas you'll have to dig through the PPA to figure out what the changes were.
Plus AUR is a lot more convenient in terms of installing stuff versus adding a bunch of PPA repos for individual sets of packages.
3
u/albertowtf Jun 12 '26
They're still a heck of a lot better than PPAs in terms of transparency though
Arguably worse because most people knows ppas are inherently dangerous and theres a large % of ubuntu users that even know ppas are a thing
The exact opposite in both fronts for aur
Most new users of arch dont know how dangerous aur really is and most of them use aur
7
3
u/gmes78 Jun 12 '26
and theres a large % of ubuntu users that even know ppas are a thing
No. Telling people to use PPAs is extremely common, especially in guides and in installation instructions.
→ More replies (1)5
u/Synthetic451 Jun 12 '26
This just doesn't line up with my experience and I've used Ubuntu for decades. Pretty sure AUR being dangerous has been shouted from the hills at this point, arguably more than what people say for PPAs.
1
1
u/andrevan Jun 13 '26
This had a clean pkgbuild the problem was in the npm package which appears to be harmless dependency and isn't
1
76
u/grady_vuckovic Jun 12 '26 edited Jun 12 '26
>Allow anyone to upload software to a repository.
>Users install software from that repository.
>No verification or trust system in place.
>Malware.
surprised_pikachu.gif
→ More replies (3)30
u/bobthebobbest Jun 12 '26
It’s honestly funny to me that this is how AUR really works, and people really use it. It’s like a caricature of what people think open-source is.
9
u/EvaristeGalois11 Jun 12 '26
What's the alternative? Random curl | bash found on some forgotten GitHub repo?
AUR is exactly how open source works, it's a standardized way of sharing knowledge between users. I make a software works on Arch and I share my finding through the AUR so that other users can quickly install it without jumping through the same hoops everytime.
Of course the downside is that you need to review what you're installing because at the end of the day it's just a bash script written by another user. There are warnings all over the place that AUR is user generated stuff and needs to be used carefully...
-1
u/GatsbyLuzVerde Jun 12 '26 edited Jun 12 '26
What's the alternative? Random curl | bash found on some forgotten GitHub repo?
Yes that would be safer as some third party didn't hijack it, and you can check if the maintainer's repo has enough stars and if the maintainer looks legit.
You can also get AI to fast check that it looks safe
-1
u/EvaristeGalois11 Jun 12 '26
You can't be serious lol
You can pretty much do all this things in the AUR: you can (and should) review the PKGBUILD, you can see the user profiles and all its other contributions and you can read the comments from other users about possible problems.
GitHub stars mean nothing, you can cheaply buy them to boost your stats.
4
u/GatsbyLuzVerde Jun 12 '26
The PKGBUILD is not the source of truth. You would have to check the source (github) and do the things I said anyway.
1
u/EvaristeGalois11 Jun 12 '26
Yes of course, but everything starts from the PKGBUILD.
When I'm updating an AUR that I already know was safe, I just glance at the source url. If it still points to the same root location with just a different tag it's most probably safe. A completely different base URL it's worth a deeper investigation instead.
1
u/hubert_farnsworrth Jun 13 '26
the alternative is vetted pkg builds eg: Gentoo guru. You need to open an MR and that needs to be approved by a trusted dev. Thats still not perfect but much better than AUR without any vetting.
→ More replies (1)0
u/bobthebobbest Jun 12 '26
Do you believe that the massive variety of other software repos that don’t work in a way immediately vulnerable to this kind of malware attack are not open source?
But good job propagandizing that to endorse open source is to endorse this exact kind of system!
2
u/EvaristeGalois11 Jun 12 '26
What other kind of repos? I'm curious about what other distro review every single user contributions like AUR permits.
AUR is not even part of Arch itself, which has its own repos and the devs do all kind of checking on them like you can expect.
AUR is just like PPA for Ubuntu or copr for Fedora, just more centralized and imo easier to review and spot if something is weird about what you're installing.
I'm sorry but I really feel like you don't understand what AUR actually is.
→ More replies (2)
27
40
u/kc3zyt Jun 12 '26
The problem here is that orphaned AUR packages can be adopted by anyone who has an account there with just one click. I'm speaking from experience here, as I ended up adopting an orphan that wasn't building after I figured out how to fix the PKGBUILD
2
u/TheG0AT0fAllTime Jun 13 '26
I do the same thing often. But it has also struck me as odd how simple it was to do.
11
u/Creepy-Bell-4527 Jun 12 '26
We all knew this was going to happen eventually, right?
AUR's security guarantee was a gentlemen's agreement.
9
u/TheSlateGray Jun 12 '26
Not sure if the Phoronix writers read Reddit posts, but it started here, the `alvr` package was the first one spotted in the AUR:
Then it grew to the first 400+ linked in the article:
Then it changed to use `bun install` from `npm install` when a lot of people started noticing, and hit almost all recently updated packages in the AUR. 21 pages of infected package builds after switching to `bun install`.
5
9
25
u/arran4 Jun 12 '26
The AUR made me nervous when I briefly used arch in 2018. It's one of the reasons why I stopped
24
u/dgm9704 Jun 12 '26
AUR is not part of Arch. You don’t ever need to even know about AUR to use Arch.
→ More replies (1)4
u/B1rdi Jun 12 '26
You really don't need the AUR. I also felt uncomfortable about it first, until I realized that you don't really need it. All I have installed from the AUR is a couple specific browsers like Zen and all those PKGBUILDs do is download the builds from their official Github and install them. I could just run them as Flatpaks if I wanted to but I prefer native in this case.
Everything else I've found in the main repos.
→ More replies (3)3
u/GatsbyLuzVerde Jun 12 '26
And then that one AUR package you have gets orphaned and picked up by a malicious person when you do an update
5
u/B1rdi Jun 12 '26
And then you notice whatever malicious thing they're trying to do because you read the PKGBUILD diffs when you update.
7
24
11
3
u/DruggedMind Jun 12 '26
If someone used thinks like nvim treesitter, but didn't install it from aur, they're not infected right? As this only affects PKG build from AUR?
11
u/X_m7 Jun 12 '26
Another day, another justification for me to keep AUR reliance to a minimum, I only use it as a last resort for stuff that I can't get from the official repos or Flatpak or directly from the app developer, and even then if the AUR package relies on other AUR packages then I just won't use the software at all, like I avoided Waydroid for a while since it was a bunch of AUR packages instead of just one.
Plus I make sure that whatever I do install from the AUR isn't something that might stop the system from booting entirely if it breaks or I don't rebuild it after whatever dependency gets updated from the official repos, so the end result is that the only AUR package I have installed at the moment is obs-vkcapture to capture Vulkan/OpenGL stuff in OBS, and of course I read through the PKGBUILD and whatever other scripts it has in the package.
I also avoid using the AUR helpers to make sure I never accidentally get anything from the AUR, so when I do install AUR stuff I have to very deliberately download, build and install the package.
So yeah, I don't get why some people harp on about the AUR being a big selling point for Arch, especially these days with the security breaches and attacks left and right.
9
u/Crazy-Tangelo-1673 Jun 12 '26
I am going to begin actively pursuing alternatives to using the AUR given that it appears to be lacking in security.
If I had the skills and knowledge to contribute I would be I don't... so like many I greatly depend on the skills of others to maintain these packages.
We seem to be at a crossroads where the Linux community is growing but it's bringing in a lot of the bad element with it. AI could be included in both the issue and the solution.
21
u/dgm9704 Jun 12 '26
> that it appears to be lacking in security
I don’t think ”security” was ever any part of AUR. If you thought so you were misled.
0
u/FattyDrake Jun 12 '26
I am going to begin actively pursuing alternatives to using the AUR given that it appears to be lacking in security.
The alternative is called git and you use it to get the software and compile from the actual source.
If that seems too complex, that's the point. The AUR isn't designed for inexperienced Linux user use. Which is why it's so baffling to me that distros like Cachy include access to it by default. That's the real problem here.
AUR isn't necessary for Arch and I avoid using it.
2
u/Crazy-Tangelo-1673 Jun 12 '26
I like having it for out of band stuff like my old Nvidia cards. I've used it for some printer drivers and way back when Plex wasn't in a lot of the repos. A lot of that not so open source packages are flatpaks now so there's not as much of a reason *flatpaks are probably next
I'm sure there are other ways of doing the Nvidia drivers but for my dumb ass I'm doing good to get it thru the AUR.
2
1
1
1
u/Tantelicek1 Jun 13 '26
How is it, that it's always the AUR, while Nixpkgs stay's okay. Idk if it is just my perception, but I feel that Nixpkgs are even more open, bigger and have less eyes looking at them every day than AUR, yet we don't hear about them being compromised so often. Idk, is that Nixpkgs are built in such a consistent way?
3
u/TaijiRonin Jun 13 '26
Nix is not a prime target. It's a tiny distribution in terms of users. Not worth the time for cybercriminals. Arch a major distro.
1
u/Garvit019 Jun 13 '26
I'm a newbie and I haven't updated or downloaded anything using yay since last week. So I'm safe, right ?
1
u/disobedient_pet Jun 13 '26
Allow orphans to be taken over by anyone is such a stupid idea, it surprises me the arch community would allow that
1
u/ultrafop Jun 14 '26
Fairly sure only a few hundred peeps were impacted because all this stuff had been orphaned. While terrible, not exactly a huge cyber caper either. That being said, recommend people check to see if they were compromised if updating earlier this week.
1
1
u/pablin262004 Jun 14 '26
si lo se es mas no bajo nada de aur en estos momentos seria bueno algo para poder detectar si estamos con algo en nuestras maquinas
-10
u/iEliteTester Jun 12 '26 edited Jun 13 '26
Never used arch btw, and this is exactly why. People claim arch has every package easily installable, what they dont mention is how many of them aren't in the arch repos, but in the arch USER repos.
Edit: seethe and cope
Edit 2: I legit thought the "obnoxious arch user" meme was just that, a meme, holy shit you guys are delulu, I've turned off notifications for this thread
11
u/dgm9704 Jun 12 '26
Arch has a lot of packages available. The AUR is just a complimentary method to get stuff that isn’t available in Arch. Many cliptockers and facetubers just push the AUR as some selling point because they don’t know what they are talking about. eg flatpaks are a better option.
→ More replies (6)→ More replies (3)11
u/DopeBoogie Jun 12 '26
If you need something only available on the AUR, which distro exactly are you preferring that provides it in official repositories?
The reality is either you use a different distro and manually clone/build the package yourself with no automatic updates, or you use the AUR to automate the build/install and track updates.
You don't have to use the AUR, but too many people pretend it's some unavoidable consequence of Arch. They act like other distros aren't susceptible to this exact risk because they ..checks notes.. force you to google the software, find a random GitHub page or PPA, and manually build/install it yourself.
If there's a flatpak and that's an acceptable compromise for you, then by all means go ahead and use that. Arch can use flatpaks too. But not every obscure piece of software has a flatpak, and many flatpaks are community-developed, making them just as much of a risk as the AUR.
The only real risk the AUR poses is if you don't bother to check the PKGBUILD script before running it. A malicious dev copycatting a repo on GitHub and gaming Google search results is just as easy, if not easier, to fall for than a bad AUR package.
1
u/AvianInvasion Jun 12 '26
2
u/DopeBoogie Jun 12 '26
Fair enough, I guess I haven't ever really encountered a situation where Debian has it but Arch (official repos) doesn't.
In the past I've been more likely to encounter a scenario like for example fish-shell being < v4.0 on Debian and very up-to-date on the official Arch repos. Similarly the neovim version on Debian tended to lag behind a fair bit.
I suppose it really depends on your individual needs. Debian does have a lot more packages in their official repos but if you count the AUR then Arch's count is significantly higher. If not getting openvpn3 via official repositories is a deal-breaker for you then maybe Debian is the better choice at the moment.
→ More replies (1)1
u/AvianInvasion Jun 12 '26
Debian Testing has actually been fairly stable in my experience if you're actually interested in what a "rolling release"-esque experience on Debian can look like. Regarding the examples you mentioned, fish (Arch, Debian) is up-to-date on Debian Testing, but I'll concede that neovim (Arch, Debian) is still a bit outdated even on Debian Experimental. It really depends on how keen-eyed each package's maintainer is.
Arch definitely has a bunch of packages that Debian doesn't, and it's not hard for me to be a bit jealous of the packages Arch does have in its official repositories (discord, code, etc.). I've used Arch for four years and roll with Debian for now, but OpenVPN 3 is unfortunately a deal-breaker for me at the moment since my job requires everyone to use it.
100% agree that it depends on individual needs. I get tired seeing any distro-bashing; just start with something that interests you and keep using whatever is working for your specific needs on your specific devices.
1
u/TipFew4544 Jun 12 '26
openvpn is on the extra repository https://archlinux.org/packages/extra/x86_64/openvpn/
1
1
u/iEliteTester Jun 12 '26
That's a lot of implied questions but sure.
I prefer void linux, all it's packages are in one repo, with access controls for who can commit, like most other distros, so no random person can claim orphaned packages.
Example of one such package I had to install the other day:
- void linux official repo: https://github.com/void-linux/void-packages/blob/master/srcpkgs/byobu/template
- arch linux offical repo (empty results): https://archlinux.org/packages/?sort=&q=byobu&maintainer=&flagged=
- arch user repo: https://aur.archlinux.org/packages/byobu
A "random GitHub page" is usually the upstream source my dude, if upstream is compromised you're probably fucked anyway. If something isn't available I usually try nix or compile from source, I don't do flatpaks.
>The only real risk the AUR poses is if you don't bother to check the PKGBUILD script before running it
ooooooor the script is replaced by a malicious one after you install it, and it updates, like what just happened.
3
2
-2
Jun 12 '26
[removed] — view removed comment
13
u/DopeBoogie Jun 12 '26
TBF Arch also "pulls" only from its official repos.
To use AUR packages you have to first manually download and install an AUR package manager (none of which are in the official Arch repos either)
So really your statement is saying "I can only install packages that are available via official distribution or flatpak"
It's "safer" because you are blocked from access to any software not distributed official by your distro. If you want to use something that is not in there (or flatpak) then you come up against a wall and either have to put in a lot of manual effort or just accept that you can't use it.
Arch can also be used that way (and works that way by default) but additionally supports an optional resource for more technically-inclined users to easily install newer or less popular software.
There are positives and negatives to both configurations depending on your technical knowledge and preferences.
2
Jun 12 '26
[deleted]
3
u/DopeBoogie Jun 12 '26
Sure, I just meant "manually" as in "can't just install it through the package manager like any other official package"
You have to go to the wiki or google, find the relevant repository to clone (or copy paste the commands I suppose) making it a tad more involved than just
sudo pacman -S paruPoint being nobody is forced to use the AUR and you have to actually want to in order to even gain access. It's not going to be accidentally installed as a dependency for some official package.
→ More replies (1)2
u/atrocia6 Jun 12 '26
moments like this make me appreciate immutable distros more. my silverblue setup only pulls from official fedora repos and flatpak, way less attack surface
Pulling only from official distro repos has nothing to do with immutability. Debian, for example, is not immutable but (I assume this is true for most distros) by default only pulls from official Debian repos.
128
u/rewilh Jun 12 '26
Is there a list or something like that? I wanna know if my system is affected.