I'm starting to think it's time the AUR introduced namespacing packages by the maintainer's AUR username. The single namespace was nice while it lasted, but it seems like we're going to need to get packages based on who's uploading them anyways...

Ah yes, I'm sure the comment section will be normal and respectful about this....

From the mailing list thread:

For the record, those are all new packages (not orphaned packages being adopted). I assume more will come, we'll clean those as soon as possible.

In the mean time stay vigilant, probably refrain from installing freshly pushed new packages from the AUR for now.

Looking over the list it's almost all git/bin versions of files. So they just added a ton of new packages like hexchat-bin that didn't have those versions before and injected malware.

Probably because it's an attack vector where the effort required to infiltrate malware is relatively low.

I wonder why Aur is a target.

You think it's Microsoft related?

Sure but npm isn't

This reads like someone asking whether it's safe to leave your front door unlocked again

Fair, and not wrong 🙂 Appreciate the reminder!

Thanks for all the replies! In a nutshell,

1. "Safe" is a relative concept with AUR.
2. Most of the affected packages were unmaintained, and probably shouldn't be installed anyway.
3. Read the diff's before updating 👍

The concept of AUR is that you run other persons scripts on your device. That is by definition a very insecure thing to do.

This boils it down fairly well, I think 🙂

It only takes a few moments to scan the diffs in a pkgbuild. It's not a big ask.

All of them?

There is not going to be an all clear. See my longer response as to why.

It always has been as safe as it always was, assuming you follow basic safety rules. One of them being to read changes, or at least glance at them, but more importantly to not use/install packets that are unmaintained. This possibly includes occasionally checking if those that you have installed are still maintained.

The recent attack has been to take over unmaintained packages, which anyone can do, and use them to inject malware. So only people that had unmaintained packages installed could even be affected. This has not been made impossible. In fact it's mostly unchanged but has been made just slightly harder by requiring (new) aur accounts to have verified mail addresses.

It is kinda hard to really "fix" this, as anyone being able to put packages in the aur is literally the point. So is someone being able to adopt an abandoned package. Changing that would fundamentally alter what the aur is. Maybe it'll eventually be necessary, but what exactly a solution would look like without literally breaking the core idea isn't exactly a trivial question either.

This reads like someone asking whether it's safe to leave your front door unlocked again because he read about a bunch of people using open front doors to rob them.

It never was safe, it never will be safe, you're trading convenience for safety, you're supposed to review the PKGBUILDS to ensure they're safe, if you can't do that you shouldn't risk it.

This is why I hate when Arch (yes, even Cachy or whatever is the current "easy" Arch) is recommended for new users. Arch assumes you know what you're doing, it expects you to read the manual, and it doesn't have kid gloves. You will get hit in the face by this and many other similar things, and will be told "it was in the manual".

I would personally still wait until the AUR maintianers give the all clear

another thing to note: after an update, when your aur tool says you have orphaned packages installed, highly consider removing them.

if you want to keep them for whatever reason, try to remember (or write them down) so if they get an update out of the blue, you can scruitinize the pkgbuild

none of the affected packages were popular and iirc all were flagged out-of-date for a long time, which is also why the attackers got access as they were abandoned.

just review pkgbuilds and pay attention to ones that get flagged out-of-date when you're updating and go check it out and find an alternative if the upstream project looks abandoned as well or install it from source instead if it's just the aur pkg.

most out of date aur pkgs i've had ended up being things that the arch team put in extra so i just needed to install that one instead anyway.

It's as safe as it always was and will be...

The concept of AUR is that you run other persons scripts on your device. That is by definition a very insecure thing to do.

Just manually read the diffs for your yay -Syu. They were adding lines to the PKGBUILDs to pull malware. Verify what each line does and you'll be fine.

I took the incident as a lesson to be more diligent about reviewing the pkgbuild before installing anything. It's understandable that not everyone will be willing to do that and I think the AUR is probably not for them, at least until there is some sort of safeguard in place.

They probably need it to have more targeted patches compared to the steam deck that are not going to fly for Arch Linux ARM which aims to support a wide range of hardware.

As one of the comments on the site points out, there's already Arch Linux ARM (ALARM), which needs support, so I presume they don't want to colobarate with them for a reason.

Yes, Im aware. Thanks anyway.

Often if there is a -bin version of a package, it is a precompiled binary and will not need to be compiled from scratch. As a general rule, the -bin version of the packages are usually preferred when available.

Uhh depends on your rig I guess. I build the various emulators from git and some of them like vita3k can take awhile.

But for me its more about being able to leave the update unattended, knowing that when I come back they will all be done and I can close the terminal window.