Just switch to windows it is safer. /s

As an user of the AUR, this is devastating news to me. I am also guilty of accepting updates without reading the latest changes, even if yay asks me if I want to. This is a reminder to everyone to only install from the AUR for absolutely necessary stuff only, and only if you trust the maintainer. And to at least have a look if something suspicious is going in with the recent changes in the package recipe. AND to read in the communities and news.

I don't understand why there still no official announcement as a warning from the Archlinux team at https://archlinux.org/news/ . Is there a different place for security news specifically about the AUR to subscribe to? EDIT: https://archlinux.org/news/active-aur-malicious-packages-incident/ They did it, an official message.

More Than 400

1579

I don't use Arch BTW.

AUR

There were announcements and security ping in the arch Linux community discord... But I wish they'd be more vocal on this outside discord especially given discords controversy as of late

Update: they finally posted about it in the arch news feed last night... A bit late but better than never. Npm removed the malicious package, but then the bad actors started using bun instead...

As others have proposed, I really think that orphaned packages should require a moderator of the aur to approve the commit and acquisition of an orphaned package. Currently nothing stops someone from spinning up accounts and hijacking these abandoned projects

The AUR is basically just a shortcut for downloading random shit off GitHub.

It gives un-experienced users a false sense of security.

Wow that’s bad 🫢

At this point, the count stands at 1500+ https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500

Whelp...I've REALLY loved EndeavourOS for my laptop, especially because I felt I could mess around with stuff, but maybe this is my call to use something like Fedora or a OpenSUSE variant (I love Tumbleweed dearly).

Nothing against the incredible Arch, but I'm deffos that user who does

> yay 
> "Build files exist. Do clean build? N"  
> "View changes? N".

ENTER.

I want to learn, but also I'm a bit of a danger to myself if this malware threat is this broad.

Ahh clearly Arch users didn't RTFM before installing shit. Skill issue.

PS: The above is an invitation to self-care, not an insult.

Maybe someone here can advise. I ran two of the available "checking" scripts to see if I have any packages installed. Both came up with 1 package I have installed. It is gtkimageview, which is on the list.

However, if I look through the pacman.log I see it was installed on 2024-10 and last upgraded 2025-01. It seems to me that suggests I installed it before this all started, so I'm probably not infected?

I learned 10 years ago not to use aur helpers because they hide the sources. Aurutils + vifm baby!

Dang, if only their packages were more up to date maybe this wouldn’t have happened.

(hopefully this doesn't read as blaming the victims instead of the attackers but) I personally don't think it's that complicated to read the updates to AUR packages. It's not any more hard than only commenting after reading the links that people post here instead of just the headlines—which we all do, right?

(btw)

This is why I use NixOS

AUR

Play stupid games win stupid prizes I guess.

Thankfully I'm clear, but I am guilty of haphazardly installing junk from the AUR, I should clean that up and uninstall everything but the stuff I really use.

Currently you can use https://github.com/lenucksi/aur-malware-check to do a check if you're infected. My main server was safe, still haven't tested on my wayland machine though, I went yolo with that one. No important keys at least are there.

I don't use arch, btw.

They should have some sort of static code scanners on the repos at rest at this point that look for certain patterns and issue warnings.

This must be fake news because several hundred people told me there is no malware on Linux.

how did this happen? the linked thread show people identifying the infected packages and cleaning them up but no word about how it happened or how to prevent it.

does a linux mint-using idiot need to worry about this, hypothetically speaking?

Definitely a few unfortunate victims to stuff like libyami if using some sort of shell autocomplete. Few others would likely catch younger people, eg the implied apk side channel deployment packages.

I wonder if a SteamDeck could somehow get infected this way...

That would surely be a rather unlikely scenario but it's interesting.

O deer

I use malware, BTW.

I bet it's NPM

(Checks list)

Yep, it's NPM

If this was 10 years ago I'd change my profile picture on Facebook to mark myself safe from the AUR malware.

For those who only have a few AUR packages installed, if you looked at the list and are still concerned, you can view the changelog at https://aur.archlinux.org/cgit/aur.git/log/?h=yourpackagenamehere. If it was secretly malicious but got missed, you'd see it there.

Every time I've had an arch distro (not often as I prefer to avoid them) and go to install from the AUR, I get to the point of checking the PKGBUILD and think "oh yeah, forgot about this" and just abort.

So 0.28% of the 140'000 packages?

Seems like not that much.

How many malicious packages are on Googles Play Store?

More info here: https://discourse.ifin.network/t/400-aur-packages-compromised-with-infostealer-and-rootkit/577

Everyone should check and make sure you don't have one of these installed.

Arrrggghhh feck. this looks bad.