The AUR is a wild place. Always has been. What else is new?

Yeah, I admire the arch linux's team transparency. A non-power user might see these news and think "linux is dangerous", without thinking that windows and mac also have malicious programs that can be installed too.

I haven't seem all packages, but some of them seem shady and with 0.0 popularity on the AUR, it's already suspicious by itself. People gotta be careful when installing AUR packages.

not allow brand new accounts to adopt orphaned packages

Is that not the case already? If not I'm sure it'll be one of the fixes.

Or make it so that the AUR has a modicum of security and not allow brand new accounts to adopt orphaned packages and immediately push out malware without any form or reviews, checks, or interventions.

What happens is this:

Arch Linux says the AUR is just a collection of user scripts. Use at your own risk. Anybody can upload some shit. Always check the PKGBUILD before you continue. Never use so-called AUR helpers to automate the process to the point that you have less control, also wrt future updates and upgrades.

Then some Arch-based distros create AUR helpers and integrate them into their distro experience, even with automatic updates & upgrades and GUIs and whatnot. Some of these distros are very popular, even more so than Arch Linux itself, in the short term. This also contributes to the pollution of the AUR. Malicious hackers are never attracted to a less popular distro that requires its users to understand what they're doing.

Blame those distros and all who contribute to AUR helpers, or tend to not read the PKGBUILD before installing - not the AUR itself.

Well, there are a lot of these packages going around the world all the time, and very seldom does anything like this happen. I just don’t want people thinking that FOSS isn’t safe.

Yeah I looked for them manually before coming across the scripts. I've been pretty careful with the aur and always check the comments on any new package I'm thinking of installing. Also I've gotten into the habit of checking the pkgbuilds after switching to paru from yay.

My last update to vidcutter was from 2025 (based on my pacman logs). Some tools will scan for "did you install the bad package during the bad time period" and some will scan for "is the bad package name installed at all" - so i was able to identify that vidcutter was installed and I knew that the package names looking familiar made sense, and I was able to manually confirm that I was still clean. And now I have a lot of system pruning to do.

But if you thing some packages look familiar, it might be worth double checking.

I thought for sure I had a few of them since some of the packages looked familiar but everything came out clean. Hopefully it stays that way.

Oh fun. I had one of the packages installed, but not an infected version, and I hadn't updated it during the window.

Feels like a great reminder to keep a clean minimal system. Why I was keeping vidcutter installed and up to date when the last time I ran it was probably years ago.

updated version: https://gist.github.com/Kidev/85756c3dcad3623ca5604a8135bafd14

https://github.com/lenucksi/aur-malware-check

https://gist.github.com/Kidev/59bf9f5fb53ab5eee99f19a6a2fc3992

As always, don't execute random scripts before checking them.

More info here: https://discourse.ifin.network/t/400-aur-packages-compromised-with-infostealer-and-rootkit/577

Everyone should check and make sure you don't have one of these installed.

PIA owner is Israeli company. Do not thrust them.

Yeah mulvad works really well.

I wasn't aware, thanks. I'll consider switching. They can spy on my torrents meanwhile :)

It's cheaper and better to just pay for a VPS and spin up a wireguard server and use that to connect to. Choose a server in a region that supports what you need and away you go.

If you are referring to a self-contained end user app then I'd recommend Mullvad. If you are referring to a protocol and want to DIY a vpn tunnel to your VPS, then Wireguard. Mullvad uses Wireguard.

is there a particular reason why the distribution matters? whatever vpn you end up using should work so long as it works on open standards.

Iirc they were proven under a supeona to have ram only servers, which isn't to say much, but that already makes them much better than most VPN providers out there

I am not going to fight you and the decisions you make are not my business.

If anyone reading this isn’t aware, pia is owned by kape technologies, a company that owns several vpn providers and was founded by members of the Israeli intelligence apparatus. That may make it more or less of a good choice depending on your goals.

Service or protocol?

You can probably use any protocol although I would caution against openvpn.

Idk of any service that doesn’t generate configs or whatever that you can easily use in arch.

There are many different reasons to use a vpn and they will all recommend different systems. Piracy benefits from port forwarding. Dodging the school/work porno filter requires many rotating endpoints. Pretending to be important enough for state level surveillance requires trust and understanding.

You can’t get everything in one service because they’re mutually exclusive. Port forwarding services roll over for cops, cheap content enabling VPNs are all owned by Israeli intelligence cutout kape technologies, schizo privacy/anonymity ones don’t do port forwarding.

The question you need to answer to get a useful response is: what are you planning on doing?

Any one supporting WireGuard.

Yep. Personally I've enjoyed PIA for years on my linux desktop, linux tablet, linux laptop, Linux VMs, raspberrypi, android phones

I use both Nym and Proton on Linux (and all my computers)

nearly any vpn should work

all recommendations you'll get will be personal preference / bias (including mine)

personally I use https://safing.io/spn/ (their fancy name for what basically is a multihop VPN), cause they have a nice gui (called portmaster, free and open source) and you can turn it on/off, set country and add custom domain rules - all on an app by app basis.