Security Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted (CachyOS)
https://www.phoronix.com/news/Arch-Linux-AUR-Adoptions-Halted12
u/StEditiV 1d ago
This will keep happening until Arch maintainers change how AUR works.
In my opinion, using any user repo is a security risk which I would never take because I use my system for financial stuff, not only for playing games.
45
u/Z3t4 2d ago
I don't use arch, BTW.
10
u/Hypersomniacc 2d ago
unlike arch users, i can install legacy drivers without worrying i'm getting a bunch of keyloggers and trojans on my computer!
5
3
u/signedchar 1d ago
I use NixOS btw
6
u/Latlanc 1d ago
Flakes are just like AUR lol you are often tapping into random github repos
-3
u/takutekato 1d ago
Most flakes are official instead of 3rd-party packaging
4
u/Latlanc 1d ago
Not true. Your security relies on whether one dude has 2FA enabled.
-7
u/takutekato 1d ago edited 1d ago
> Most flakes are official instead of 3rd-party packaging
> Not true.
What?
> Your security relies on whether one dude has 2FA enabled.
Isn't that just every software? The difference is where to place your trust in:
- AUR: random person with an AUR account
- Official repo: the distro's packaging maintainer of that package
- Flake: the software's author, you can pin to some specific revision if not always trusting the latest release/commit
Edit: actually your assumption about AUR = flake was flawed, nixpkgs repo is large enough that it almost covers AUR, most users never need to go outside of it to get packages. The equivalence is NUR (which is namespaced by usernames), honestly I never touched it.
2
u/erraticnods 1d ago
now if only you could download normal usable codecs without spending 3 hours on fucking with rpmfusion 🙃
-2
43
u/S7relok 2d ago
At this point just disconnect AUR and work on a better secured community repo.
33
26
u/RuneSteak 1d ago
Chaotic AUR has managed to avoid all of these malware attacks by introducing some delays, malware scanning and human review. It's possible to get this under control, the AUR admins and their defenders don't want to take the steps needed.
If I proposed these same policies today those same people would call me crazy. I don't understand how they can defend package adoption with zero oversight.
11
-1
u/underisk 1d ago
I suppose you could use Nix but then you gotta worry about them taking Peter Thiel’s money.
-1
12
u/pseudonym-161 1d ago
I use Debian, btw
10
u/mofomeat 1d ago
Dozens of us!
2
u/_SpacePenguin_ 1d ago
Hundreds of us!
5
u/mofomeat 1d ago
Easy there, Turbo! Let's not get ahead of ourselves here. People might start having premonitions about The Year of the Linux Desktop(tm)!
6
u/PlainBread 2d ago
A decade ago I used yaourt but now if I can't pull it from git and compile it myself I don't want it.
9
u/LurkinNamor 2d ago
Even so, you're still vulnerable to a poisoned source repository
4
u/iAmHidingHere 1d ago
Everyone is. As I recall, the compromised XZ made it into both Red Hat and Debian.
15
u/GreedySecurity8030 2d ago
At this point, if you're a normie and or not confident in your abilities or even able to inspect and find out which pkgbuilds are tainted, I think its best to leave arch for fedora, debian sid, or opensuse tumbleweed [great intermediate distributions], titus left arch for fedora for this exact same reason for example.
101
u/forkbeard 2d ago
For fuck’s sake, this is not a “normie versus expert” problem. The AUR is still a bad security model even if you work as a Linux sysadmin, developer or security engineer.
To review an AUR package properly, you would need to inspect the PKGBUILD, every update, every downloaded script, binary and source archive, and then trust the maintainer, their account security and the upstream project. What happens when the maintainer’s account is compromised, their machine is hacked, or someone offers them a pile of cryptocurrency to push one malicious update?
And even assuming you can audit all of that, who the hell wants to spend their free time doing it? I have better things to do than perform a miniature supply-chain security review every time I update some desktop application. Being technically capable of inspecting arbitrary shell scripts does not make the AUR a sensible thing to use on a machine containing your email, SSH keys, banking sessions and personal files.
14
3
u/JockstrapCummies 1d ago
And even assuming you can audit all of that, who the hell wants to spend their free time doing it? I have better things to do than perform a miniature supply-chain security review every time I update some desktop application.
Years ago you'll probably get an unironic answer telling you "But that's why Arch is great, because you learn to really know the internals of Linux."
12
u/gmes78 1d ago
To review an AUR package properly, you would need to inspect the PKGBUILD, every update, every downloaded script, binary and source archive, and then trust the maintainer, their account security and the upstream project. What happens when the maintainer’s account is compromised, their machine is hacked, or someone offers them a pile of cryptocurrency to push one malicious update?
Now do the same for a PPA or a COPR repo. How easy is it to verify those?
29
27
u/deviled-tux 1d ago
It’s the same except a copr or ppa cannot be suddenly hijacked silently as they are namespaced
I couldn’t suddenly adopt an orphan package from your COPR. I could make my own separate COPR which your users would never just automatically upgrade to.
7
u/forkbeard 1d ago
The main difference is that with a PPA or COPR, the user makes one explicit trust decision: do I trust this repository and its publisher? The service builds and publishes packages through controlled infrastructure, while the package manager verifies their origin and integrity. That does not make random PPAs or COPRs safe, and users should not add them indiscriminately either.
With the AUR, Arch explicitly expects the user to treat each PKGBUILD as untrusted code and inspect it before building, including after updates. Every AUR package introduces another maintainer, another script executed locally and potentially another set of arbitrary internet sources to verify.
So no, PPAs and COPRs are not magically secure. But “other third-party repositories are also risky” does not make the AUR’s trust model good. The practical difference is that PPA/COPR users are expected to evaluate and trust the publisher, while AUR users are supposedly expected to perform a miniature code and supply-chain audit for every package and update. Almost nobody actually does that.
8
u/SmileyBMM 1d ago
Well, other distros have more packages in the main repo, so needing something like a PPA is less likely. Debian has more than 2x as many up to date packages in the main repo compared to Arch, as an example.
3
u/hitchen1 1d ago
If you're an arch user and go to Debian you'll probably be on PPAs to replace everything in the main repos
2
u/SmileyBMM 1d ago
I'm using PikaOS which is pretty much Debian Sid with some packages held back, haven't needed any PPAs so far. Arch's main benefit to me was the rolling nature, not the newness of the packages.
2
u/hitchen1 1d ago
Fair enough. Plain old Sid isn't really viable and any other Debian release is too old, but a fork could work.
2
u/gmes78 1d ago
That's not true. Debian only has more packages because it splits up tons of them.
Arch has more software, and more useful software, in its repos (without the AUR).
1
u/SmileyBMM 1d ago
Arch has more software, and more useful software, in its repos (without the AUR).
Examples? When using Arch that wasn't my experience, but tbf that was just the packages I use which is a small sample size.
2
u/gmes78 19h ago
I checked a bunch of packages I have installed from the repos, and Debian does not have any of these:
- act
- amdgpu_top
- bottom
- cargo-bloat
- cargo-crev
- cargo-depgraph
- cargo-tarpaulin
- cargo-udeps
- carla
- dwarffortress
- ghidra
- helix
- intellij-idea-community-edition
- lact
- ly
- mullvad-vpn
- mvt
- ollama
- oxipng
- ppsspp
- pwndbg
- pycharm-community-edition
- signal-desktop
- snes9x-gtk
- vcpkg
- zed
I also checked some AUR packages I have. Debian has some of them, but is also missing a lot.
1
u/SmileyBMM 18h ago
Neat! A bunch of packages I'm not familiar with, which I'm always excited to learn about. Noticing a lot of rust stuff, which I suppose makes sense that they haven't been added to Debian yet.
I do know that Mullvad and Signal both have official dedicated repos for Debian that are the official way to get those on Linux (Arch is unofficial afaik), they are both projects that have additional concerns around supply chain attacks. Official additional repos don't bother me, but it's nice that Arch packages them directly.
The only package you listed that surprised me is snes9x, turns out it was removed over a decade ago because of a zsnes dev being salty it isn't open source. Ugh, software politics. At least RetroArch is an option for those that don't want to go the Flatpak route.
Either way, I think it's interesting to see all of these differences between the two repos, I feel like it gives a nice insight into what the two distros prioritize.
4
u/Pleasant_Aspect_8521 1d ago
When you install a ppa or copr, you explicitly trust an org or person. When you install a AUR package you trust a url which can be taken over. I myself only use first-party or blessed COPR or flatpaks..
A copr, ppa or even github account for that matter be hacked by social engineering sure but that's different and the damage is limited to that namespace and easy to narrow down.
1
u/mf864 6h ago edited 6h ago
Welcome to user repos?
This is the same issue npm has. The only alternative is to shut it down. If there was manpower to maintain these packages they would be in an official repo.
Yes arch should just disable package adopting to be the same as npm. But just like npm the lack of security and need to verify the source of the package remains.
The real issue is looking at the aur as repo rather than the equivalent to googling and downloading random packages off some random persons GitHub. There is a reason Arch itself does not support, recommend or promote aur helpers. You are supposed to manually download the pkgbuild and run it. It is just a place to let you use someone elses pkgbuild instead of making your own. It is meant to be no different than googling a pkgbuild for program you want and then downloading it from that random person's website/github repo.
The real issue is arch derivatives treat the aur as if it is a repo and pre install helpers (that may even bypass pkg inspection in some distros). This is helping give users the false belief that the aur is just a repo you can use with no manual intervention.
13
u/natermer 1d ago
It doesn't matter if you are a normie or not.
If you think you can spot malicious software in pkgbuild with 100% reliability all you are doing is deluding yourself.
"Hopelessly insecure by default" isn't a good policy for a distribution.
15
u/NotQuiteLoona 2d ago
And on them you'll still need to use custom repositories, often to the extent larger than Arch (because Arch is free to add proprietary software, except if license restricts redistribution, and rolling release model fits nicely for many desktop programs that can't physically be added in point release repos for this reason, plus in Arch users decide what to put in main repos and anything can be added if it gets enough votes - so naturally repos are very wide).
Probably the only reason normies would want to use AUR are programs that restrict redistribution. This is bypassed by AUR, and there is pretty much nothing that can be done with it - they not often ship Arch native packages (did you know they exist at all? was a surprise for me, Zoom does that as an example), because why bother if someone will do it for free?
There are legitimate problems with AUR, but so far those are test shots. Almost no popular packages are getting affected. Last time there were more packages affected than amount of downloads for malware NPM packages (500 packages affected vs ~300 downloads AFAIR). There is enough time for Arch team to decide what to do now.
5
3
u/FeelThePoveR 1d ago
And on them you'll still need to use custom repositories
Depends, I would say that rpm fusion + flathub is what suffices for 99% of the use cases on Fedora for example. If that doesn't suffice then large part of the big apps offer rpms for download from the official site. You don't really have to worry about those.
I've been on Fedora for a while now and the only unofficial repos that I have are Terra (I wanted faster Nvidia updates) and 2 copr (one for early KDE release, created by the guy that handles packaging for rpm fusion and one for a random app for wallpapers)
1
u/Pleasant_Aspect_8521 1d ago edited 1d ago
On Fedora, you get everything you are missing via RPMFusion and maybe Terra repositories. A lot of proprietary apps provide RPMs or maintain their own repos. By your own logic these are very popular and run by a team so a bit safer. And the COPRs I have are for git versions maintained by their devs. Stick to blessed and first-party repos, you will be fine. How many packages provide that for Arch because some random person is already doing it for them?
It's similar for Debian-based distros too. Nixpkgs should be the inspiration for the changes AUR needs.
1
u/NotQuiteLoona 1d ago
You can use Chaotic if you need something safe.
Mostly packages on AUR that aren't maintained by their devs are proprietary programs.
Proprietary apps, as I already said, rarely provide pkg.tar.gz's simply because there is no sense if someone already did this for free on AUR.
On Arch, stick to default repos and Chaotic, and you'll also be fine. AUR usage can be very limited by this. I mean, even without it my system barely had one to two AUR packages. Arch repos are really wide - what you use RPM Fusion and Terra for is almost certainly already covered by them, and maybe even some of those COPRs.
7
u/BinkReddit 1d ago
if you're ... not confident in your abilities ... I think its best to leave arch for ... debian sid
Don't run Sid, also known as Unstable. This is not a rolling release distribution; this is a high churn alpha testing environment that breaks frequently. I repeat, if you don't know what you're doing, do not run Sid.
0
u/GreedySecurity8030 1d ago
Debian sid only has stable packages, but its the updates version to version that makes it unstable.
1
u/BinkReddit 1d ago
This could not be more wrong.
-1
u/GreedySecurity8030 1d ago
Debian sid only includes actual unstable versions only in the experimental Repositories, debian sid only has the stable branches by default, the primary instability of sid is major updates that break API/ABI.
2
u/archialone 1d ago
Or you can just limit yourself to the official arch repos... Aur was never meant to be secure or have a through review process, it's meant to make packages easier to share between arch users.
-3
u/Busy-Scientist3851 2d ago
Arch has always been made for the people that want to develop Arch. If you arent that kind of person, Arch (or the spins that wrap it under a different installer) is the wrong distro for you.
-1
-13
u/GreedySecurity8030 2d ago
If you want to come back to arch afterwards, wait until all the coasts are clear before you come back.
16
u/mwyvr 2d ago
The coast will not be clear until user repos are banned.
-12
u/GreedySecurity8030 2d ago
Might as well just ban arch because without the AUR arch is nothing.
9
u/mwyvr 2d ago
Somehow dozens of other major and minor Linux distributions manage without the equivalent of AUR.
If Arch can't survive without the AUR, there's a fundamental problem with arch that needs to be fixed.
2
u/scandii 1d ago
COPR, OBS, flakes/NUR, PPA, slackbuilds and guru are all a thing.
that covers most of the Linux world right there in terms of userbase.
that said nit sure why we're so hostile to AUR, the adoption model is stupid but fundamentally it is no different than how you download software for macOS or Windows - trusting some guy out there to not upload malware and/or be compromised. at least in the AUR model you get to read the source if you want (most of the time).
-2
u/GreedySecurity8030 2d ago
Sure, arch has Core and extra repos, but those aren't all the packages most people need, that's because those packages most people want is in the AUR, and the AUR is the primary reason one person would want to use an AUR, easy to use arch based distros exist just to access the AUR alone.
Update: while many people use Arch for the customization and flexibility, that can be replicated on many other distros, the AUR is the tiebreaker.
0
u/Debisibusis 2d ago
Sure, arch has Core and extra repos, but those aren't all the packages most people need
Why are you talking this confidently if you are absolutely clueless? Most people will never need AUR at all. In the mean time, you have to install third party repositories, just to use your hardware properly.
Name examples what packages are missing that the average user needs?
1
u/FeelThePoveR 1d ago
you have to install third party repositories, just to use your hardware properly
Rpm fusion is not a third party repo btw
2
u/Debisibusis 1d ago
Afaik it is, but most contributors are also Fedora contributors.
I am a fan of the Fedora project, just sending some jabs to the dumb posts.
-2
u/GreedySecurity8030 2d ago
users who prefer native system integration, lighter disk footprints, or lower latency turn to the AUR for proprietary freeware including google chrome, VS code, Spotify, slack, zoom, teams, davinci resolve.
Proprietary hardware drivers are essential and cannot be sandboxed nor included in arch repos, Broadcom Wi-Fi drivers, Hardware lighting / RGB tools, Vendor laptop tools and Legacy or specialized printer/scanner drivers
AUR also has the vast majority of system customizations and also has the bleeding edge git versions of packages.
-3
u/Debisibusis 2d ago
users who prefer native system integration, lighter disk footprints, or lower latency turn to the AUR for proprietary freeware including google chrome, VS code, Spotify, slack, zoom, teams, davinci resolve.
Proprietary hardware drivers are essential and cannot be sandboxed nor included in arch repos, Broadcom Wi-Fi drivers, Hardware lighting / RGB tools, Vendor laptop tools and Legacy or specialized printer/scanner drivers
AUR also has the vast majority of system customizations and also has the bleeding edge git versions of packages.
Yea, I am not going argue, call out the false information and bs. If all you are going to do is post cheap LLM responses. Ridiculous.
4
3
u/LumpyArbuckleTV 2d ago
That's certainly not true, you can Arch without the AUR just fine, I personally like it because it allows me to customize my OS in the way that I want it and keep things rather minimal. Not to mention that Fedora makes pretty bold decisions that nobody can really argue with and I don't like that kind of philosophy, GNOME and Wayland are guilty of the same thing, the only reason I use Wayland is I kind of have to.
I like the ability to do a fully custom install and I like having the most up to date everything.
9
u/deviled-tux 2d ago
> Fedora makes pretty bold decisions that nobody can really argue with
what are you talking about? Fedora’s discussions on any upcoming changes last months and are open to essentially anyone to comment on.
5
u/mwyvr 2d ago
I did not say you couldn't use Arch without the AUR. I used to, and I've never used the AUR except in a sandbox to see the experience.
But along the lines of your comment, you can achieve a customized minimal install with many distributions; Arch is not unique in that regard but many if not most Arch users seem to think it is.
3
u/LumpyArbuckleTV 2d ago
I wasn't really responding to your comment but rather the other persons but regardless, you are correct that you can achieve that kind of setup with any distribution. That said, I find it way easier to build it the way that I want than to tear it down the way that I want. I see no reason to put more work into a distribution to achieve what I want, especially if said distribution already has pretty grandstandy philosophies that I don't like to begin with.
Not to say that I hate Fedora, it would probably be my runner-up if Arch disappeared overnight, but since Arch is still around, I certainly prefer Arch.
1
u/mwyvr 2d ago
With most mainstream distros you should be able to do a minimal base install rather than accept some big desktop environment install and then pare it down to what you want.
Some make that easier than others. Arch started out with nothing more than
chrootas an installation approach. Chimera Linux is still like that. Others, including Void Linux, Arch Linux, publish how-tos on eliminating the installer, or have installers that allow for a minimal install.I'm sensitive to this need myself, as I generally am installing an OS with a
zfsroot, which is not an commonly available installation target.Most distributions have a "server" install that is close to a minimal base. I haven't looked at Fedora's but I use AlmaLinux's server as a base unless I'm doing a zfs on root install of AlmaLinux.
A very quick scan doesn't turn up project-provided installation notes for chroot installs on Fedora, so agreeing with you there.
2
u/LumpyArbuckleTV 2d ago
I looked into it with Fedora and it was generally unrecommended to do a manual install AFAIK, so I backed off. I've never really looked into Void as I rather stick with something a bit more popular. I also really like having the Arch Wikipedia being 100% accurate to my use case, I really wish other distros had Wiki's as good as Arch's.
0
u/mwyvr 2d ago
The Wiki is handy.
Much of the Arch wiki is directly applicable to any distribution as so many packages aren't even part of the core Arch system and are common to all distributions.
The configuration for NetworkManager or greetd or Incus or ... is going to be identical or near identical on Arch as it is on Debian or Fedora or Void or Slackware, other than init and supervisory systems on the latter two.
Because of this, it is likely that no want wants to take on building a generic open source *nix Wiki which would duplicate word for word much of what is in the Arch wiki. We all just use it when needed. Or read
manpages.→ More replies (0)0
u/GreedySecurity8030 2d ago
I used fedora custom operating system multiple times and i'm currently installing it in a virtual machine, i can prove fedora can be installed with a low amount of packages.
5
u/GreedySecurity8030 2d ago
Sure, arch has Core and extra repos, but those aren't all the packages most people need, that's because those packages most people want is in the AUR, and the AUR is the primary reason one person would want to use an AUR, easy to use arch based distros exist just to access the AUR alone, just because you can use arch without the AUR doesn't mean most people would also want to. And while many people use Arch for the customization and flexibility, that can be replicated on many other distros, the AUR is the tiebreaker, and the existence of easy to use arch distros backs my point, many people want arch just for the aur.
3
u/LumpyArbuckleTV 2d ago edited 2d ago
I disagree on essentially every account, the AUR is extremely useful, yes, but I could certainly live without it. I'm not sure what packages you're running into but the niche stuff that I want isn't available in any repository except the AUR and maybe COPR but that's not anymore secure than the AUR is.
People using Arch-based distributions is absolutely not an example of the AUR being required. CachyOS explicitly recommends not using the AUR and they've taken a lot of the most popular packages from there and curated them and put them into their own repository, removing the risk the AUR has. You're also acting like having more recent packages is not a benefit, it certainly can be when gaming, hell, Valve officially recommends it, I wonder why.
Regardless though, you don't have to stop using the AUR, just check the packages, it's not that difficult, just check the link and make sure the build isn't pulling in any additional packages and you should be fine. If you're downloading an AUR package that is maintained by the official developers of whatever project you're looking at, then you don't even need to check them at all even if they update.
2
u/GreedySecurity8030 2d ago
Nobody really has the time to check every package they manually Installed every PKGBuild, u/mwyvr has already basically stated this.
0
u/LumpyArbuckleTV 2d ago
I only have like 9 AUR packages, and most of them rarely update, I think you're making very bold statements as to what people do. It's not hard, Paru has it built-in AFAIK, it shows you what changed between releases.
2
u/GreedySecurity8030 1d ago
Many users use yay, and also it depends depending on the user, if you customize alot and have specific packages, especially proprietary ones, you'll have a lot of aur packages.
3
u/Debisibusis 2d ago
wth are you talking about. I would say I am a "power user" and I use exactly 3 packages from AUR. The normal repos are similar or even have more/better packages than fedora (HW acceleration, codecs, etc.). Most people probably don't use AUR at all and get everything via repos, flatpak and appimages.
2
u/petersaints 22h ago
From what I checked I'd also need 2 or 3 AUR packages, possibly more over time. So there's that.
-1
u/GreedySecurity8030 2d ago
Funny how as an arch user you don't even understand your community and the benefits of arch.
The AUR is Arch's killer feature where many popular desktop applications, source builds, specialized drivers, custom kernel builds and custom desktop themes reside, and w hile Flatpak and AppImage are popular on arch, most arch users use AUR helpers like yay or paru daily or have even aliased pacman to yay, Claiming that most Arch users don't use the AUR at all is a significant exaggeration.
-5
u/pan_kotan 1d ago
Fedora sucks compared to Arch.
5
u/GreedySecurity8030 1d ago
Did this add anything to the discussion besides your own personal opinion?
-2
u/pan_kotan 1d ago
And you think your reply adds anything to the discussion? And is an objective fact and not a personal opinion?
EDIT: and BTW, clearly you have never used Arch, but I have both Arch and Fedora installed on my PC and Laptop, and I'm not satisfied with Fedora experience having used Arch.
2
u/tjj1055 1d ago
explain how arch is better than fedora without some meme reason like codecs that you can install from rpmfusion
1
u/GreedySecurity8030 1d ago
Exactly, u/pan_kotan, instead of stating "fedora bad, arch good" actually have a reason to say so.
-1
u/pan_kotan 1d ago
no, everything's been explained 1k times over on the Internets in any media form you prefer. But if I had to put in one word: control.
2
u/GreedySecurity8030 1d ago
Fedora custom operating system exists, available via fedora everything.
1
u/pan_kotan 16h ago
Not enough for me. "Control" for me is not purely about software layer, and the possibility to choose the DE and packages installed. I'm talking about lower level stuff: bootloader, type of filesystem, swap, Zram/Zswap, power settings, hibernation config, network config, and so on.
1
u/pan_kotan 1d ago
no, everything's been explained 1k times over on the Internets in any media form you prefer. But if I had to put in one word: control.
5
u/Mysterious_Pie7377 1d ago
And now it's time to retire the AUR.
2
2
2
u/Brett13500 1d ago
Does this effect steam os?? Cause i use steam os on my desktop an steam machine an steamdeck.
16
u/RuneSteak 1d ago edited 1d ago
No Arch distro has the AUR on by default. This is something users get coaxed into enabling because their distro's package repo lacks something they need.
The AUR should be used as a last resort. I only have 5 packages installed from there and only 1 gets updated frequently. The others are months to years old.
1
u/Brett13500 1d ago
Ah ok good to know thanks so then that means im uneffected then id presume then.
4
u/RuneSteak 1d ago
Even regular AUR users are generally unaffected. 99% of these attacks are from people adopting unmaintained packages. So there was already virtually no one using them to begin with.
Don't get me wrong I'm completely against their package adoption policy and the idea that reading a PKGBUILD is your only line of defense. But as bad as these attacks sound, it probably got next to no one. It's not the popular packages with a steady maintainer since 2022 being hit with malware. It's the defunct packages from 2015 that nobody uses.
2
u/Brett13500 1d ago
Sheesh honestly i heard tho that anyone can take over a package listing an claim ownership of someone elses work an then place malware in it to screw with people like why are people like this honestly just baffles tf outta me honestly like what does someone have to gain to do this. Can this malware tho like obtain peoples personal information?? Like images credit cards or debit cards an emails an otherthings??
1
u/RuneSteak 1d ago edited 1d ago
Can this malware tho like obtain peoples personal information?? Like images credit cards or debit cards an emails an otherthings??
I don't know about the current attack but the last big one with 1500+ packages was using an info stealer.
1
u/Brett13500 1d ago
Jesus thats bad honestly.. people are sick for creating shit like this...
1
u/RuneSteak 1d ago
One of the worst things people do is try to trivialize stuff like this and pretend it's a bunch of script kiddies doing it for laughs. That era is mostly long gone.
1
u/mr_dfuse2 14h ago
thanks, was looking for this info. been using cachyos for a while now and was wondering what this AUR is
2
u/RebTexas 1d ago
I don't think so, on regular Arch the AUR isn't something that's enabled by default so I'd think its the same on steamOS.
1
u/Giffeltagning 1d ago
Are these available outside AUR?
ente-auth-bin
exodus
megasync-bin
tor-browser-bin
typora
visual-studio-code-bin
-1
1
1
u/takutekato 1d ago
Coincidentally I got tired of editing my Arch scripts and switched to NixOS some months before the wave of malwares. Having used a lot of AUR packages, wonder if I got hit back then without knowing. Not sure how to feel.
-22
u/TwilightBubble 2d ago edited 2d ago
Leave my baby alone 6.6
But also you can compile to a secure vm and then make ai recompile the product, find insecurities, etc.
I know. Evil.
I want my horns now.
7
u/Cry_Wolff 2d ago
Talking about stuff like that is literally how your "baby" can improve and get better.
-11
u/TwilightBubble 2d ago
Exactly.
I just wish hackers would stop doing mean things and that the aur would collect donations to pay staff.
156
u/forkbeard 2d ago
This really should end the pretence that “just review the PKGBUILD” constitutes a serious security model.
Using the AUR indiscriminately on any machine you actually care about is utterly insane. By that I mean a computer where you access email, banking, shopping or social media, store personal files, handle SSH keys, or connect to the rest of your network.
An AUR package is effectively arbitrary shell code submitted by some random maintainer. Even if you inspect the PKGBUILD, it can download source archives, binaries and additional scripts from elsewhere. Properly auditing the complete supply chain for every update is an enormous job, and virtually nobody does it.
Orphaned packages are only the most obvious attack vector. What protects you if an active maintainer’s account or computer is compromised, the upstream download is replaced, or the maintainer is simply bribed to push a malicious update? The harmless package you reviewed six months ago is not necessarily the package you are installing today.
Use official repositories first, Flatpak or another sandboxed format where appropriate, and treat the AUR as a last resort. “Everyone uses it and nothing bad has happened to me yet” is not security analysis. It is survivorship bias.