57
Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware (www.phoronix.com)
submitted 4 months ago by to c/archlinux@lemmy.ml
6 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 11 points 4 months ago (5 children)

More info here: https://discourse.ifin.network/t/400-aur-packages-compromised-with-infostealer-and-rootkit/577

Everyone should check and make sure you don't have one of these installed.

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 9 points 4 months ago* (last edited 4 months ago) (4 children)
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 5 points 4 months ago* (3 children)

    Oh fun. I had one of the packages installed, but not an infected version, and I hadn't updated it during the window.

    Feels like a great reminder to keep a clean minimal system. Why I was keeping vidcutter installed and up to date when the last time I ran it was probably years ago.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 4 months ago (2 children)

    I thought for sure I had a few of them since some of the packages looked familiar but everything came out clean. Hopefully it stays that way.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 4 months ago (1 child)

    My last update to vidcutter was from 2025 (based on my pacman logs). Some tools will scan for "did you install the bad package during the bad time period" and some will scan for "is the bad package name installed at all" - so i was able to identify that vidcutter was installed and I knew that the package names looking familiar made sense, and I was able to manually confirm that I was still clean. And now I have a lot of system pruning to do.

    But if you thing some packages look familiar, it might be worth double checking.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 4 months ago

    Yeah I looked for them manually before coming across the scripts. I've been pretty careful with the aur and always check the comments on any new package I'm thinking of installing. Also I've gotten into the habit of checking the pkgbuilds after switching to paru from yay.

  • permalink
  • fedilink
  • source
  • parent