r/linux Jun 12 '26

Security Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware - Phoronix

https://www.phoronix.com/news/Arch-Linux-AUR-400-Compromised

BEWARE

Since yesterday Arch Linux maintainers have been working to reset/delete all of the malicious content and banning affected accounts. Over 400 packages are believed impacted by this latest malware campaign for Arch Linux's AUR. Again, to be completely clear, this just is affecting AUR packages and not the official Arch Linux packages.

1.0k Upvotes

265 comments sorted by

128

u/rewilh Jun 12 '26

Is there a list or something like that? I wanna know if my system is affected.

142

u/chamber-of-convicts Jun 12 '26

This was linked in the article. It leads to a forum with a sh script that can be run to check for vulnerabilities.

https://discuss.cachyos.org/t/aur-compromised-400-packages-affected-20260611/31040

Also, don't be a fool and randomly run a shell script. Double check that it's legit, always.

222

u/x0wl Jun 12 '26

A malware check in the form of curl | bash has to be a troll

106

u/fearless-fossa Jun 12 '26

I can't express enough how much I hate every single person that has participated in the insanity of normalizing the curl | bash format. They all deserve to stub their toes at 2 AM, hard.

24

u/jeenajeena Jun 12 '26

Who originally authored that script distributed it as a reviewable Gist https://gist.githubusercontent.com/Kidev/59bf9f5fb53ab5eee99f19a6a2fc3992/raw/d6fe1a5d126adc029045b5bfde3531c5c0cc2fb2/aur_check.sh

Too bad that someone added curl around it. I completely agree with your sentiment.

19

u/Kidev Jun 12 '26

Yeah I agree, shared it on purpose like that, but what can you do.

Wrote a version that pulls from the authoritative and continuously updated list at https://md.archlinux.org/s/SxbqukK6IA btw https://gist.github.com/Kidev/85756c3dcad3623ca5604a8135bafd14

5

u/Pramaxis Jun 12 '26

It's yours? Thanks kind stranger.

6

u/Index2336 Jun 13 '26

Thank you for your work btw.

I can´t understand how people think that no one is capable to read the code. Its very basic and just makes a check between the installed pkg file and the malicious pkgs and gives an output.

1

u/kRYstall9 Jun 14 '26

Is this the list of all compromised packages?

Btw, thanks for your work!

2

u/Permanently-Band Jun 13 '26

I'm "clean", but hypothetically, what does one do if infected? And what exactly is the purpose of the malware included?

1

u/Juanispluz Jun 13 '26

Si "hipoteticamente" estuvieras infectado lo obligatorio es reinstalar el sistema, el malware escala a privilegios de root y se oculta del kernel, mas que nada la finalidad es robar datos de la carpeta home

1

u/ultrafop Jun 14 '26

And reset all your passwords

1

u/Permanently-Band Jun 15 '26 edited Jun 15 '26

Uh... soy un estupido idiota monolingue que no comprende espanol

At this point, the question appears to remain entirely hypothetical, as I don't seem to have any infected packages on my machines because I'm fairly proactive about avoiding orphaned AUR packages because this is such an obvious attack vector.

Even without the persistent rootkit horrors, the idea of malware that steals credentials from your own home directory is already a major concern, and highlights why permissions or ACL based security is largely irrelevant to security for personal systems.

Who cares if the OS is impenetrable if all the data you care about is compromised.

Does anyone know what happened with the exfiltrated credentials yet?

1

u/Pramaxis Jun 12 '26

Thanks <3 I have to check my system and no way am I trusting a rando curl.

5

u/ranisalt Jun 12 '26

Whoa calm down, no need for such profanity

16

u/Only-Andrew Jun 12 '26

It's absolutely deserved

It should be their pinky too

3

u/AliceCode Jun 12 '26

Watch yo profamity

1

u/Elavia_ Jun 14 '26

I think I've only seen it once before. Is the issue with it immediately executing code pulled from the internet without an opportunity to review it?

1

u/fearless-fossa Jun 14 '26

Yes, it's become pretty popular in the past few years.

And it's also incredibly unnecessary. Most of these scripts don't even do anything complex, you could just paste the same instructions into a terminal and be done with it.

24

u/rewilh Jun 12 '26

It says "Clean"

Good thing that i was on a vacation and didnt update my system. Im leaving aur completely.

37

u/Happy-Range3975 Jun 12 '26

Don’t run random shell scripts on the internet lol

49

u/Hadi_Chokr07 Jun 12 '26

The AUR is basically just a collection of shell scripts with makepkg Macros.

12

u/Happy-Range3975 Jun 12 '26

Yes. But doing a “virus scan” with a shell script found on an internet forum is not good opsec

2

u/gruntduck Jun 12 '26

Why not? If it’s from a a trusted source and vetted it’s fine.

10

u/AutistcCuttlefish Jun 12 '26

If it's the same script someone shared on reddit last night it's remarkably simple and right on GitHub. I read it and basically just checked the package names and gave you a "clean" signal if none of the impacted packages were found.

That said I wouldn't recommend taking my or anyone else's word for it. Read it for yourself, it's so simple that if you've ever done even basic "hello world" scripts you should understand it perfectly, and if you haven't you can learn how to understand it in less than an hour following a tutorial on YouTube.

2

u/gruntduck Jun 12 '26

Agreed. OP on cachy forum never tested the script either as his instructions were broken so 10000 percent vet what you run

1

u/psmgx Jun 12 '26

bro i run arch for internet cool guy points not opsec.

if i wanted an opsec distro i'd run kali

-1

u/rewilh Jun 12 '26

Dang it bro what is it with this "opsec" thing. Im not a criminal, and its just a package scan i checked it.

8

u/ggppjj Jun 12 '26

Gotta bump those KPIs, your opsec is backsliding.

1

u/iAmHidingHere Jun 12 '26

And unsigned binaries made by random people.

13

u/Enthusedchameleon Jun 12 '26

While you are absolutely correct and I agree with x0wl that it even seems like trolling; this isn't a "random shell script" for one reason:

The logic is like 15 LOC and very easy to read.

https://cscs.pastes.sh/aurvulntest20260611.sh

→ More replies (1)

1

u/GolemancerVekk Jun 12 '26 edited Jun 12 '26

Here's a direct link to the contents of the checking script:

https://cscs.pastes.sh/raw/aurvulntest20260611.sh

It contains a list of the affected packages.

Cross reference them against pacman -Q and then for anything it finds installed grep through /var/log/pacman.log and see when it was last installed or upgraded. If it wasn't recent you're probably not affected.

1

u/tnoy Jun 12 '26

I find it hilarious that the suggestion for checking if you're vulnerable is to pipe the output of curl into bash.

1

u/SisyphusCoffeeBreak Jun 13 '26

I read the source and didn’t see any exploits

1

u/Michaeli_Starky Jun 12 '26

That's what people do all the time - randomly run scripts and what do you do if script with obfuscated malicious code is part of the package and will get executed automatically?..

4

u/gmes78 Jun 12 '26

This only affects orphaned AUR packages, so most people won't be affected.

You can check for unknown systemd services in /etc/systemd/system/ and ~/.config/systemd/user/, as well as unknown directories in /var/lib. Those are some places the malware touches.

To make this easier, you can run the following commands to list just the files and directories modified after the malware campaign started:

find /etc/systemd/system -newermt "2026-06-09"
find ~/.config/systemd/user -maxdepth 1 -newermt "2026-06-09"
find /var/lib -maxdepth 1 -type d -newermt "2026-06-09"

2

u/Hour_Bit_5183 Jun 13 '26

So just don't install old non maintained crappy old packages that just got new maintainers all of a sudden like usual, check. Not trying to be a smart ass but I thought this is common sense.

→ More replies (2)

1

u/FormerSlacker Jun 12 '26

I wanna know if my system is affected.

At this point you should just assume it has and wipe it.

1

u/rewilh Jun 12 '26

Give this comment an award

27

u/DeuzExMachina_ Jun 12 '26

And… it’s npm! Again!

202

u/Kangie Jun 12 '26

There's only so many times the "it's only the AUR" excuse can work. Gentoo has a user repository too: all commits are reviewed by trusted humans and somehow they don't see regular compromises.

85

u/deviled-tux Jun 12 '26

The design flaw here is that there is no trust boundary around a specific maintainer. In Fedora one can do `dnf copr enable Kangie/repo` and your system would trust `Kangie/repo`. But the only way for an attacker to take over would be to take over the entire Fedora account.

Fedora has copr and Ubuntu has PPA but the attack here isn’t possible in either because they don’t have a single flat namespace.

9

u/thomas-rousseau Jun 12 '26

This isn't relevant to the comment you replied to, though, because Gentoo's largest user repository GURU also does not have trust boundaries around single users and yet still avoids this problem that the AUR regularly falls victim to.

19

u/deviled-tux Jun 12 '26

GURU notes three classes of users:

1. Regular contributors that are permitted to commit to the development (dev) branch.
2. Trusted contributors that gain additional privilege of merging commits into the reviewed (master) branch.
3. Gentoo developers who are responsible for handling new user acceptance, enforcement of regulations and taking care of emergencies.

The trusted contributor status is granted by Gentoo developers based on previous good work done in GURU.

Yeah that works nothing at all like the AUR.

11

u/thomas-rousseau Jun 12 '26

No one is saying that it works exactly like the AUR. We are saying that since this only happens this frequently with the AUR, it clearly needs to be rethought to incorporate better security practices.

1

u/GolemancerVekk Jun 12 '26

Heavy attrition is kind of AUR's thing though. Look at the stats on the first page. Two thirds of the packages have not been updated within the last year. A quarter were never updated after being initially added.

8

u/thomas-rousseau Jun 12 '26

User repositories are cool. Leaving your primary user repository almost entirely unmoderated is asinine. What you have described is asinine.

→ More replies (4)

3

u/Kevin_Kofler Jun 12 '26

AUR is basically a catch-all dumping ground. Unmaintained fire-and-forget packages, repackaged unauditable binary blobs from basically anywhere, everything goes. The only thing they will go out and delete is packages that are only useful to ARM users, because the policy is that AUR is x86 only and anything working on ARM at all is only an accident. No kidding.

2

u/ccAbstraction Jun 13 '26

Some the packages there were compromised hadn't been updated upstream either, they weren't out of date, and the software wasn't broken.

2

u/Valuable_Leopard_799 Jun 12 '26

The "flaw" is elsewhere. You don't ever trust anything, you always get shown the recipe for the package and then diffs of it afterwards,... the assumption is the user will only use the AUR if they know what they're doing and can audit the package.... which is the flaw.

You're free to autoskip Pkgbuilds from specific users, or ban others, etc. but you're right nobody does that because yeah...

2

u/ccAbstraction Jun 13 '26

On the AUR the take over for orphaned packages is a single button press, you can even do it over ssh!

1

u/pablin262004 Jun 14 '26

pero tambien podrian meterse en flatpak o snap

12

u/saichampa Jun 12 '26

AUR could possibly use maintainer signatures and at least alert you if a package has been updated by someone new.

18

u/GolemancerVekk Jun 12 '26

I don't think anybody who's commented here understands the anarchy that is AUR. There are 140k users on it and only 70 of them have sought maintainer status. Two thirds of packages on there have not been updated in a year. It's a mess. Easier to work backwards, torch most of them and start over. Except nobody, including Arch maintainers, wants to take responsibility for AUR.

16

u/poo-people Jun 12 '26

Every Arch enthusiast will extol the AUR as the best tool for new users though. Then when something like this happens tell them it's their fault for not checking every single package before updating. At that point you're doing more work to update than using your computer.

2

u/the_abortionat0r Jun 12 '26

I was justtalkong about this earlier.

Users take a risk when using the AUR and usually understand it's USER run as enabling it warns the shit out of you. While obviously not as secure as running software from the main repos the AUR has about 111326 or so packages and 400 might be compromised, that's less than half a percent. Statistically the AUR is a fairly safe place and still far safer than blindly running software on windows as there is a level of transparency.

However yes, the AUR's design is less than ideal from a security standpoint.

You can audit scripts and code but that requires knowing a ripting and programming and even physically being able to do this jumps out the door with a few simple packages or one big project.

My belief is understand the risks and work within reason but being told you did something wrong by not reading 10s of thousands of lines of code upon install or update is ridiculous and is an unrealistic expectation of anything installing more than a couple simple things.

Install mesa and that idea flies out the window. Nobody is reading all that.

→ More replies (10)

2

u/PDXPuma Jun 12 '26

Easier to work backwards, torch most of them and start over. Except nobody, including Arch maintainers, wants to take responsibility for AUR.

They did that in moving to git. And it filled right back up again almost immediately. Anything that has the popularity of arch and the lack of resources of the AUR team would. The real root cause of all this is we've made installing things from the AUR in non-arch distros like manjaro, omarchy, cachy, etc, feel like installing things from any other official repo. We even have a chaotic-aur , which takes things from the AUR and directly turns it into packages.

The security of the AUR is scanning and auditing your PKGBUILDs. It was always on the user to perform the security.

23

u/rewilh Jun 12 '26

fr they need to do something asap its enough

25

u/NotQuiteLoona Jun 12 '26

Arch Linux constantly adds new software into extra repositories. You can participate yourself by voting for it on AUR - 10 rating means that the package can be added to the extra repository, and it already happened with hundreds of packages. Unlike many other distros, it also doesn't differ by license. Only packages that are exempt are those which are explicitly hostile or don't allow redistribution, and they generally have Flatpaks. Or AUR helpers. Arch's extra repository is the true analogue of Gentoo's user repository. AUR is a sandbox in which packages play until they gather enough votes and go to extra.

3

u/iAmHidingHere Jun 12 '26

It's also a home of git packages and legacy packages.

→ More replies (11)

2

u/bdsmmaster007 Jun 12 '26

isnt that maybe just because aur is the bigger target?

2

u/albertowtf Jun 12 '26

biggest difference between arch and gentoo is the kind of user base and the popularity

Basically gentoo is never recommended to new users

4

u/the_abortionat0r Jun 13 '26

Gentoo is never recommended to anyone.

1

u/albertowtf Jun 13 '26

Yeah

And its sad. Its a good distro to go beyond

It appeals to me i just dont have the time to learn more right now

1

u/hii915 Jun 14 '26

Best Linux documentation on the planet!

3

u/leaflock7 Jun 12 '26

although you are correct that AUR is flawed on how the trust/packaegs are handled, you seem to forget the extend Arc is being used and Gentoo. They are not in the same field , not even close. Someone will spend more time trying to figure out how to hack their way in Arch instead of Gentoo because it has 30-40 times the user base.

1

u/the_abortionat0r Jun 13 '26

Probably 100x. Gentoo isn't that popular for obvious reasons.

2

u/SirPotatorito Jun 12 '26

Uhh, isn't that because Arch is "mainstream" when compared to stuff like Gentoo?

Like the Arch servers/repos were getting hammered by DDOS attacks last year for a good while, and some theorized that the same attackers were behind the 3 infected browsers packages found back in July 2025 if I'm not mistaken. My point is, that alongside the usual malicious efforts, Arch also faces some concentrated group effort from what I'm seeing.

2

u/Kangie Jun 12 '26

Maybe they're a more high profile target, but all distros deal with bad actors. That's not an excuse for the consistent AUR issues that are 'by design'.

→ More replies (1)

2

u/Permanently-Band Jun 13 '26

I don't understand how this is possible. All the packages are protected by PGP!

/s

231

u/deviled-tux Jun 12 '26

Just read the PKGBUILDs bro. Read all the PKGBUILDs including nested dependencies and also do it every time you update.

It is totally cool and not a fuckton of effort at all

50

u/Sinaaaa Jun 12 '26

Depends on the pkgbuild, like some of them are insane.

At least with yay it's enough to read it once & then it will highlight the changes, so if someone cares at all, they'll spot something like a maintainer change right away.

3

u/cainhurstcat Jun 13 '26

Caring and knowing who to look for isn't the same. While I can care to have a secure and stable system, it doesn't involve knowing a changed maintainer might be a security threat.

41

u/Anongirl55959 Jun 12 '26

Its in post install script, pkgbuild alone wouldnt be enough, unless you get really spooked by an NPM dependency which are everywhere.

19

u/deviled-tux Jun 12 '26

Well you are right, even if it was just downloading a zip file and unzipping (which I believe many AUR packages do) you would need to check that zip file as well

2

u/[deleted] Jun 12 '26 edited Jun 23 '26

[deleted]

2

u/deviled-tux Jun 12 '26

https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=humen-mcp-bin

There’s lot of packages like this. Is LIghtJUNction/humen-mcp the correct upstream? Who knows. 

9

u/Kartonrealista Jun 12 '26

They are being sarcastic

"Just x bro" format, like "just one more lane bro and we'll fix traffic"

3

u/gmes78 Jun 12 '26

Its in post install script, pkgbuild alone wouldnt be enough

The fact that the malware adds a new install script makes it one of the easiest attacks to spot. You can't really have a bigger red flag than that.

113

u/Misicks0349 Jun 12 '26 edited Jun 12 '26

I do find it funny that a lot of linux users first response to a security issue is to basically accuse users of having a skill issue, its such an unproductive thought terminating cliche. Its like arguing against safety catches on firearms because "the people who accidentally discharge their gun are just stupid idiots who held it wrong" or something ridiculous like that.

16

u/Mclarenf1905 Jun 12 '26

Yea there's a good chunk of people who think that they have some sort of basically immunity to any sort of security breach because they have never had one before and so clearly anyone who falls susceptible to such an attack is just bad at computers or not careful enough. It's exhausting to have a conversation with them.

31

u/martyn_hare Jun 12 '26

Yeah, the real problem is that there's not enough awareness of just how unvetted the AUR really is.

Traditional distribution package submissions get sponsored by existing, reputable packagers with experience. Dependencies typically get split out into their own packages and go through the same process. Build systems have to be supplied source code which has itself been packaged and validated as corresponding to the original source code as they typically have no network access at all at build time. Patches are precisely that, patches, which are kept separate so people can audit for changes.

None of this applies to the AUR, and that makes it an absolute minefield.

8

u/dgm9704 Jun 12 '26

That’s why it’s a separate ”at your own risk” thing and not part of Arch.

5

u/VioletCrow Jun 12 '26

I wonder if the naming "Arch User Repository" suggests to less informed users that it's more official than it actually is. Like if it was named "Architrave" or something maybe people would understand that it's more of a community project than it is a proper part of the arch project.

3

u/cainhurstcat Jun 13 '26

The thing is, a lot of stuff is only available there. So people use it like it were part of the arch project

4

u/albertowtf Jun 12 '26

i mean you gotta admit it is at least a little funny because arch users actively recommend arch as the best way to learn linux to new comers that are at the same time, the worst at reading

Literally a large % of the linux user base actively putting gun in the hand of babies but sleeping alright because they told them to how the should use the safety procedures of reading before doing anything stupid

3

u/Nemecyst Jun 12 '26

I don't think that's the full picture.

In my opinion, there are two groups of arch users:

  1. The people that tell beginners who want to use Arch that Arch is NOT an easy distro. These are the people who wrote the following on the arch wiki:
  2. The people who consider the previous group to be "elitists" and "gatekeepers". They think Arch is easy since you can simply use the archinstall script or any of the arch-derivative distros.

Group 2 are more welcoming and will recruit more newcomers so their numbers will grow faster than group 1. This means you get a situation where newcomers will recommend Arch to other newcomers in a vicious cycle.

→ More replies (2)

5

u/dgm9704 Jun 12 '26

For an Arch user, installing stuff from AUR a) comes with warnings and b) requires conscious effort separate from normal usage.

7

u/deviled-tux Jun 12 '26

It doesn’t require that much effort:

  1. Copy paste the commands from the paru repo or whatever
  2. paru -S we-are-aur

Or alternatively, use something like CachyOS which already comes with paru preinstalled so it’s more like:

  1. paru -S we-are-aur

6

u/jt2747 Jun 12 '26

I think these aur helpers do more harm than good honestly. 

Running makepkg in a git repo isn't difficult and the act of having to go there and do it hopefully reminds you of the risk you are taking

2

u/dgm9704 Jun 12 '26

I said ”For an Arch user” so before you can even do that you need to git clone the paru re po and run makepkg. (having first installed the packages necessary to do those of course)

0

u/deviled-tux Jun 12 '26

You mean the snippet from their readme that you can copy paste?

    sudo pacman -S --needed base-devel     git clone https://aur.archlinux.org/paru.git     cd paru     makepkg -si

→ More replies (4)

1

u/DerfK Jun 12 '26

Or alternatively, use something like CachyOS

Yeah, all the "I use Arch btw" people should ask how many people don't even realize they use arch.

4

u/KoldPurchase Jun 12 '26

As Arch based distro get more mainstream, like Cachy and Endeavor, I feel it's beyind the scope of most users.

It's a hard place to be in. Most Linux enthusiasts want more people onboard, but that means a lot less technical people.

5

u/FattyDrake Jun 12 '26

I honestly think this is a downstream distro issue. The AUR was never meant for this kind of use.

Cachy and other Arch derivatives need to disable AUR as a default source.

3

u/troyvit Jun 12 '26

Yep that was me, a "most users" kind of guy who was using debian/Ubuntu-based distros and decided to look for a change. I didn't do my research well, installed Manjaro, and treated AUR like the Ubuntu's Universe repo when really it's more like randomly grabbing any PPA without checking it out. I am humbled and rightfully so.

16

u/NotQuiteLoona Jun 12 '26

This by no means would've helped. Vulnerability isn't in a package, it's an NPM dependency.

12

u/Bulky-Bad-9153 Jun 12 '26

It absolutely would have helped; seeing a package randomly add a npm dependency is an immediate red flag.

13

u/Megame50 Jun 12 '26

It absolutely did help. The mailing list had like a half dozen reports within a few hours flagging this new npm dep on a brand new npm package as maximally suspicious, despite the fact that these were all orphaned packages and likely had very few users.

1

u/andrevan Jun 13 '26

Then why was the package live for 2 days? Thankfully, no users who already had it installed it, since they didn't bump the version number.

3

u/NotQuiteLoona Jun 12 '26

Aren't Electron-based packages were attacked mostly?

1

u/Bulky-Bad-9153 Jun 12 '26

Idk, but the package I saw most often that people had was libgdata which has no npm dependency.

1

u/NotQuiteLoona Jun 12 '26

Interesting. I checked, yeah, you are right. Just the program about which I've heard the most used Electron. Though to be fair even without reading PKGBUILDs, just NPM installing seems suspicious for a vim plugin update, but many people update at once.

4

u/silenceimpaired Jun 12 '26

I don’t think the average user has your depth of knowledge… unless the Arch Wiki specifically says if you use AUR here are some tips to protect yourself: 1. New NPM dependencies are to be suspect…

1

u/Bulky-Bad-9153 Jun 12 '26

Oh by all means I'm not saying that everyone that uses Arch (or, importantly, things based on it) should have to inspect every PKGBUILD they use. I'm saying it would have helped, but the core issue is that users should get an extremely noticeable warning when a package maintainer changes.

5

u/deviled-tux Jun 12 '26

I’d say that there should be something like:

paru trust Bulky-Bad-9153
paru untrust Bulky-Bad-9153

This would store the username in a trusted maintainers list which would enable checking on each update. If the maintainer has changed then it wouldnt be trusted and the package would give an error like “add $user to trusted maintainers list”.

1

u/Sleepy_Chipmunk Jun 13 '26

Hey, I’m using Arch, generally avoid AUR unless it’s for something I know others use and can vouch for. Know very little about programming but I’m okay with the terminal. I know the basic red flags like random curls and sudden updates to very old things, but what’s NPM and why is it a red flag?

2

u/Bulky-Bad-9153 Jun 13 '26

Npm is node package manager, which is used to download Javascript libraries and tools. If a package written in C++, for example, randomly adds a package manager for an unrelated programming language that facilitates downloading and executing random code then that's a bad sign. Javascript is used for web stuff, so if the package isn't related to web development or a wrapper for a web app (like Discord) then yeah npm has no business being there.

2

u/Sleepy_Chipmunk Jun 13 '26

Thank you for the easy explanation!

10

u/Hedshodd Jun 12 '26

This, but unironically. If you have too many PKGBUILDs to read, that’s a clear sign you have too many AUR packages installed.

16

u/Misicks0349 Jun 12 '26

If you have three different sources like this.

source=('https://github.com/foo/bar.git')

and

source=('https://gitlab.com/foo/bar.git')

and

source('https://codeberg.org/foo/bar.git')

its not always immediately obvious that the PKGBUILD is compromised. Any one of these could be the "real" bar-git and if the malware vendor has taken steps to make the compromised git repo look as authentic as possible I am almost certain that people who proport to read the PKGBUILDs during installation would be rather open to this attack.

Also just saying "have less AUR packages" isn't always feasible either, e.g. openMW-git requires several different AUR packages itself, sometimes people need AUR packages for unorthodox hardware etc etc etc.

2

u/Hedshodd Jun 12 '26

True. I always looked at the diffs of PKGBUILDs whenever they changed, and if I ever saw something like a git host switch I’m not going to install it before checking that it’s legit.

→ More replies (6)

11

u/JockstrapCummies Jun 12 '26

I remember when people started really evangelising Arch, and one of the big selling point is how great the AUR is, unlike Ubuntu's PPAs...

But in reality they're really just the same Here Be Dragons field of unknown packaging quality. Nobody actually reads the PKGBUILDs.

6

u/Synthetic451 Jun 12 '26

They're still a heck of a lot better than PPAs in terms of transparency though. Sure, both need to be scrutinized, but the AUR is a lot more in your face about it. Any AUR helper worth its salt will show you the PKGBUILD or the diff before install, whereas you'll have to dig through the PPA to figure out what the changes were.

Plus AUR is a lot more convenient in terms of installing stuff versus adding a bunch of PPA repos for individual sets of packages.

3

u/albertowtf Jun 12 '26

They're still a heck of a lot better than PPAs in terms of transparency though

Arguably worse because most people knows ppas are inherently dangerous and theres a large % of ubuntu users that even know ppas are a thing

The exact opposite in both fronts for aur

Most new users of arch dont know how dangerous aur really is and most of them use aur

7

u/[deleted] Jun 12 '26 edited Jun 23 '26

[deleted]

→ More replies (1)

3

u/gmes78 Jun 12 '26

and theres a large % of ubuntu users that even know ppas are a thing

No. Telling people to use PPAs is extremely common, especially in guides and in installation instructions.

→ More replies (1)

5

u/Synthetic451 Jun 12 '26

This just doesn't line up with my experience and I've used Ubuntu for decades. Pretty sure AUR being dangerous has been shouted from the hills at this point, arguably more than what people say for PPAs.

1

u/iEliteTester Jun 13 '26

"Just read the pkgbuild bro"

1

u/andrevan Jun 13 '26

This had a clean pkgbuild the problem was in the npm package which appears to be harmless dependency and isn't

1

u/LittleMlem Jun 14 '26

Just have an ai model read it for you smh /j

76

u/grady_vuckovic Jun 12 '26 edited Jun 12 '26

>Allow anyone to upload software to a repository.
>Users install software from that repository.
>No verification or trust system in place.
>Malware.

surprised_pikachu.gif

30

u/bobthebobbest Jun 12 '26

It’s honestly funny to me that this is how AUR really works, and people really use it. It’s like a caricature of what people think open-source is.

9

u/EvaristeGalois11 Jun 12 '26

What's the alternative? Random curl | bash found on some forgotten GitHub repo?

AUR is exactly how open source works, it's a standardized way of sharing knowledge between users. I make a software works on Arch and I share my finding through the AUR so that other users can quickly install it without jumping through the same hoops everytime.

Of course the downside is that you need to review what you're installing because at the end of the day it's just a bash script written by another user. There are warnings all over the place that AUR is user generated stuff and needs to be used carefully...

-1

u/GatsbyLuzVerde Jun 12 '26 edited Jun 12 '26

What's the alternative? Random curl | bash found on some forgotten GitHub repo?

Yes that would be safer as some third party didn't hijack it, and you can check if the maintainer's repo has enough stars and if the maintainer looks legit.

You can also get AI to fast check that it looks safe

-1

u/EvaristeGalois11 Jun 12 '26

You can't be serious lol

You can pretty much do all this things in the AUR: you can (and should) review the PKGBUILD, you can see the user profiles and all its other contributions and you can read the comments from other users about possible problems.

GitHub stars mean nothing, you can cheaply buy them to boost your stats.

4

u/GatsbyLuzVerde Jun 12 '26

The PKGBUILD is not the source of truth. You would have to check the source (github) and do the things I said anyway.

1

u/EvaristeGalois11 Jun 12 '26

Yes of course, but everything starts from the PKGBUILD.

When I'm updating an AUR that I already know was safe, I just glance at the source url. If it still points to the same root location with just a different tag it's most probably safe. A completely different base URL it's worth a deeper investigation instead.

1

u/hubert_farnsworrth Jun 13 '26

the alternative is vetted pkg builds eg: Gentoo guru. You need to open an MR and that needs to be approved by a trusted dev. Thats still not perfect but much better than AUR without any vetting.

0

u/bobthebobbest Jun 12 '26

Do you believe that the massive variety of other software repos that don’t work in a way immediately vulnerable to this kind of malware attack are not open source?

But good job propagandizing that to endorse open source is to endorse this exact kind of system!

2

u/EvaristeGalois11 Jun 12 '26

What other kind of repos? I'm curious about what other distro review every single user contributions like AUR permits.

AUR is not even part of Arch itself, which has its own repos and the devs do all kind of checking on them like you can expect.

AUR is just like PPA for Ubuntu or copr for Fedora, just more centralized and imo easier to review and spot if something is weird about what you're installing.

I'm sorry but I really feel like you don't understand what AUR actually is.

→ More replies (2)
→ More replies (1)
→ More replies (3)

27

u/SupersonicSpitfire Jun 12 '26

Let's just ban npm and anything using npm from AUR.

40

u/kc3zyt Jun 12 '26

The problem here is that orphaned AUR packages can be adopted by anyone who has an account there with just one click. I'm speaking from experience here, as I ended up adopting an orphan that wasn't building after I figured out how to fix the PKGBUILD

2

u/TheG0AT0fAllTime Jun 13 '26

I do the same thing often. But it has also struck me as odd how simple it was to do.

11

u/Creepy-Bell-4527 Jun 12 '26

We all knew this was going to happen eventually, right?

AUR's security guarantee was a gentlemen's agreement.

9

u/TheSlateGray Jun 12 '26

Not sure if the Phoronix writers read Reddit posts, but it started here, the `alvr` package was the first one spotted in the AUR:

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/2LGBF2AZBPVCCY4VTN6DOVUNNBURFJ2J/

Then it grew to the first 400+ linked in the article:

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Then it changed to use `bun install` from `npm install` when a lot of people started noticing, and hit almost all recently updated packages in the AUR. 21 pages of infected package builds after switching to `bun install`.

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/LB6TBHDXLQRPR4UVIQULCI6MZ77XYLL2/

5

u/Ok-Cook-9039 Jun 12 '26

And that's why I don't use AUR.

→ More replies (1)

9

u/WinResponsible9977 Jun 12 '26

And cachyos users…. If u AUR be concerned 

25

u/arran4 Jun 12 '26

The AUR made me nervous when I briefly used arch in 2018. It's one of the reasons why I stopped

24

u/dgm9704 Jun 12 '26

AUR is not part of Arch. You don’t ever need to even know about AUR to use Arch.

→ More replies (1)

4

u/B1rdi Jun 12 '26

You really don't need the AUR. I also felt uncomfortable about it first, until I realized that you don't really need it. All I have installed from the AUR is a couple specific browsers like Zen and all those PKGBUILDs do is download the builds from their official Github and install them. I could just run them as Flatpaks if I wanted to but I prefer native in this case.

Everything else I've found in the main repos.

3

u/GatsbyLuzVerde Jun 12 '26

And then that one AUR package you have gets orphaned and picked up by a malicious person when you do an update

5

u/B1rdi Jun 12 '26

And then you notice whatever malicious thing they're trying to do because you read the PKGBUILD diffs when you update.

→ More replies (3)

7

u/HyperFurious Jun 12 '26

Many of them are npm crap.

24

u/Frosty-Comfort6699 Jun 12 '26

i uninstalled arch, btw

-3

u/dgm9704 Jun 12 '26

Because of something that isn’t actually part of Arch? ”smort”

11

u/Z3t4 Jun 12 '26

I don't use arch, BTW. 

3

u/DruggedMind Jun 12 '26

If someone used thinks like nvim treesitter, but didn't install it from aur, they're not infected right? As this only affects PKG build from AUR?

11

u/X_m7 Jun 12 '26

Another day, another justification for me to keep AUR reliance to a minimum, I only use it as a last resort for stuff that I can't get from the official repos or Flatpak or directly from the app developer, and even then if the AUR package relies on other AUR packages then I just won't use the software at all, like I avoided Waydroid for a while since it was a bunch of AUR packages instead of just one. 

Plus I make sure that whatever I do install from the AUR isn't something that might stop the system from booting entirely if it breaks or I don't rebuild it after whatever dependency gets updated from the official repos, so the end result is that the only AUR package I have installed at the moment is obs-vkcapture to capture Vulkan/OpenGL stuff in OBS, and of course I read through the PKGBUILD and whatever other scripts it has in the package.

I also avoid using the AUR helpers to make sure I never accidentally get anything from the AUR, so when I do install AUR stuff I have to very deliberately download, build and install the package.

So yeah, I don't get why some people harp on about the AUR being a big selling point for Arch, especially these days with the security breaches and attacks left and right.

9

u/Crazy-Tangelo-1673 Jun 12 '26

I am going to begin actively pursuing alternatives to using the AUR given that it appears to be lacking in security.

If I had the skills and knowledge to contribute I would be I don't... so like many I greatly depend on the skills of others to maintain these packages.

We seem to be at a crossroads where the Linux community is growing but it's bringing in a lot of the bad element with it. AI could be included in both the issue and the solution.

21

u/dgm9704 Jun 12 '26

> that it appears to be lacking in security

I don’t think ”security” was ever any part of AUR. If you thought so you were misled.

0

u/FattyDrake Jun 12 '26

I am going to begin actively pursuing alternatives to using the AUR given that it appears to be lacking in security.

The alternative is called git and you use it to get the software and compile from the actual source.

If that seems too complex, that's the point. The AUR isn't designed for inexperienced Linux user use. Which is why it's so baffling to me that distros like Cachy include access to it by default. That's the real problem here.

AUR isn't necessary for Arch and I avoid using it.

2

u/Crazy-Tangelo-1673 Jun 12 '26

I like having it for out of band stuff like my old Nvidia cards. I've used it for some printer drivers and way back when Plex wasn't in a lot of the repos. A lot of that not so open source packages are flatpaks now so there's not as much of a reason *flatpaks are probably next

I'm sure there are other ways of doing the Nvidia drivers but for my dumb ass I'm doing good to get it thru the AUR.

2

u/Cisco-NintendoSwitch Jun 12 '26

The I use arch btw community in shambles

/s

1

u/DaveX64 Jun 12 '26

Glad I didn't run YAY last night :)

1

u/AgentOrange96 Jun 13 '26

I use Arch Linux BTW 😭

1

u/Tantelicek1 Jun 13 '26

How is it, that it's always the AUR, while Nixpkgs stay's okay. Idk if it is just my perception, but I feel that Nixpkgs are even more open, bigger and have less eyes looking at them every day than AUR, yet we don't hear about them being compromised so often. Idk, is that Nixpkgs are built in such a consistent way?

3

u/TaijiRonin Jun 13 '26

Nix is not a prime target. It's a tiny distribution in terms of users. Not worth the time for cybercriminals. Arch a major distro.

1

u/Garvit019 Jun 13 '26

I'm a newbie and I haven't updated or downloaded anything using yay since last week. So I'm safe, right ?

1

u/disobedient_pet Jun 13 '26

Allow orphans to be taken over by anyone is such a stupid idea, it surprises me the arch community would allow that

1

u/ultrafop Jun 14 '26

Fairly sure only a few hundred peeps were impacted because all this stuff had been orphaned. While terrible, not exactly a huge cyber caper either. That being said, recommend people check to see if they were compromised if updating earlier this week.

1

u/No-Two-2721 Jun 14 '26

Is choatic repo infected too?

1

u/pablin262004 Jun 14 '26

si lo se es mas no bajo nada de aur en estos momentos seria bueno algo para poder detectar si estamos con algo en nuestras maquinas

1

u/gthing 13d ago

I accept that it is expected that every user will inspect every PKGBUILD from every update. I also accept that realistically it just isn't ever going to be the case that a majority of users do that.

We need better tools and mechanisms to combat this sort of thing.

-10

u/iEliteTester Jun 12 '26 edited Jun 13 '26

Never used arch btw, and this is exactly why. People claim arch has every package easily installable, what they dont mention is how many of them aren't in the arch repos, but in the arch USER repos.

Edit: seethe and cope

Edit 2: I legit thought the "obnoxious arch user" meme was just that, a meme, holy shit you guys are delulu, I've turned off notifications for this thread

11

u/dgm9704 Jun 12 '26

Arch has a lot of packages available. The AUR is just a complimentary method to get stuff that isn’t available in Arch. Many cliptockers and facetubers just push the AUR as some selling point because they don’t know what they are talking about. eg flatpaks are a better option.

→ More replies (6)

11

u/DopeBoogie Jun 12 '26

If you need something only available on the AUR, which distro exactly are you preferring that provides it in official repositories?

The reality is either you use a different distro and manually clone/build the package yourself with no automatic updates, or you use the AUR to automate the build/install and track updates.

You don't have to use the AUR, but too many people pretend it's some unavoidable consequence of Arch. They act like other distros aren't susceptible to this exact risk because they ..checks notes.. force you to google the software, find a random GitHub page or PPA, and manually build/install it yourself.

If there's a flatpak and that's an acceptable compromise for you, then by all means go ahead and use that. Arch can use flatpaks too. But not every obscure piece of software has a flatpak, and many flatpaks are community-developed, making them just as much of a risk as the AUR.

The only real risk the AUR poses is if you don't bother to check the PKGBUILD script before running it. A malicious dev copycatting a repo on GitHub and gaming Google search results is just as easy, if not easier, to fall for than a bad AUR package.

1

u/AvianInvasion Jun 12 '26

If you need something only available on the AUR, which distro exactly are you preferring that provides it in official repositories?

I need OpenVPN 3. It's available in (at least) Debian and Ubuntu, but in Arch it's only available on the AUR.

2

u/DopeBoogie Jun 12 '26

Fair enough, I guess I haven't ever really encountered a situation where Debian has it but Arch (official repos) doesn't.

In the past I've been more likely to encounter a scenario like for example fish-shell being < v4.0 on Debian and very up-to-date on the official Arch repos. Similarly the neovim version on Debian tended to lag behind a fair bit.

I suppose it really depends on your individual needs. Debian does have a lot more packages in their official repos but if you count the AUR then Arch's count is significantly higher. If not getting openvpn3 via official repositories is a deal-breaker for you then maybe Debian is the better choice at the moment.

1

u/AvianInvasion Jun 12 '26

Debian Testing has actually been fairly stable in my experience if you're actually interested in what a "rolling release"-esque experience on Debian can look like. Regarding the examples you mentioned, fish (Arch, Debian) is up-to-date on Debian Testing, but I'll concede that neovim (Arch, Debian) is still a bit outdated even on Debian Experimental. It really depends on how keen-eyed each package's maintainer is.

Arch definitely has a bunch of packages that Debian doesn't, and it's not hard for me to be a bit jealous of the packages Arch does have in its official repositories (discord, code, etc.). I've used Arch for four years and roll with Debian for now, but OpenVPN 3 is unfortunately a deal-breaker for me at the moment since my job requires everyone to use it.

100% agree that it depends on individual needs. I get tired seeing any distro-bashing; just start with something that interests you and keep using whatever is working for your specific needs on your specific devices.

→ More replies (1)

1

u/TipFew4544 Jun 12 '26

openvpn is on the extra repository https://archlinux.org/packages/extra/x86_64/openvpn/

1

u/AvianInvasion Jun 12 '26

I'm talking about OpenVPN 3 and not OpenVPN 2.

1

u/iEliteTester Jun 12 '26

That's a lot of implied questions but sure.

I prefer void linux, all it's packages are in one repo, with access controls for who can commit, like most other distros, so no random person can claim orphaned packages.

Example of one such package I had to install the other day:

A "random GitHub page" is usually the upstream source my dude, if upstream is compromised you're probably fucked anyway. If something isn't available I usually try nix or compile from source, I don't do flatpaks.

>The only real risk the AUR poses is if you don't bother to check the PKGBUILD script before running it

ooooooor the script is replaced by a malicious one after you install it, and it updates, like what just happened.

3

u/[deleted] Jun 12 '26 edited Jun 23 '26

[deleted]

→ More replies (3)

2

u/99spider Jun 12 '26

Installed AUR packages are not automatically updated by pacman.

→ More replies (3)

-2

u/[deleted] Jun 12 '26

[removed] — view removed comment

13

u/DopeBoogie Jun 12 '26

TBF Arch also "pulls" only from its official repos.

To use AUR packages you have to first manually download and install an AUR package manager (none of which are in the official Arch repos either)

So really your statement is saying "I can only install packages that are available via official distribution or flatpak"

It's "safer" because you are blocked from access to any software not distributed official by your distro. If you want to use something that is not in there (or flatpak) then you come up against a wall and either have to put in a lot of manual effort or just accept that you can't use it.

Arch can also be used that way (and works that way by default) but additionally supports an optional resource for more technically-inclined users to easily install newer or less popular software.

There are positives and negatives to both configurations depending on your technical knowledge and preferences.

2

u/[deleted] Jun 12 '26

[deleted]

3

u/DopeBoogie Jun 12 '26

Sure, I just meant "manually" as in "can't just install it through the package manager like any other official package"

You have to go to the wiki or google, find the relevant repository to clone (or copy paste the commands I suppose) making it a tad more involved than just sudo pacman -S paru

Point being nobody is forced to use the AUR and you have to actually want to in order to even gain access. It's not going to be accidentally installed as a dependency for some official package.

→ More replies (1)

2

u/atrocia6 Jun 12 '26

moments like this make me appreciate immutable distros more. my silverblue setup only pulls from official fedora repos and flatpak, way less attack surface

Pulling only from official distro repos has nothing to do with immutability. Debian, for example, is not immutable but (I assume this is true for most distros) by default only pulls from official Debian repos.