Been saying for years that people need to stop treating the AUR like a repo, when it’s more akin to
curl installscript.sh | bash.So, better to use a safe language, and use
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs/ | sh- right??
(I copied that from https://rust-lang.org/tools/install/ just a second ago…)
cue RuSt Is ThE fUtUrE people.
Some packages pull files from personal dropbox…
But it is a repo. It’s just an unofficial one. I don’t know how you use it without understanding this. It’s not far from perfect, but it is useful.
the problem is exactly the fact that it is a repo; it introduces a layer of unknown between the dev and the user. and the user will unavoidably “trust” it (especially when it’s listed amongst official repos in e.g. the graphical version of Pamac), without understanding the risks.
I think a lot of people are confusing what the AUR actually IS. It is NOT the official package repository used by Archlinux - it’s more like a bunch of community install scripts for stuff that isn’t officially supported yet - for popularity or other reasons.
So for all those people complaining and saying “debian does it better” it’s very likely that you would not even HAVE a package to install and would have to come up with a build script on your own - the AUR allows you to skip this and instead just verify that the script itself isn’t malicious, which is usually fairly obvious.
A lot of people here seem to be under the impression that all of this effort should be abstracted for them - but that’s what you chose when you left windows - a system that you control intimately with a necessitation to actually do some upkeep yourself because a giant company isn’t doing it for you.
In other words. RTFM and stop expecting other people fix all your problems for you, because that’s exactly how windows got to how it currently is.
it’s more like a bunch of community install scripts for stuff that isn’t officially supported yet - for popularity or other reasons.
I’m looking at the list of affected packages and many of them are in official debian repos. Isn’t the issue then that the official Arch repositories don’t have many packages and people have to use less secure sources? That still sounds like an Arch issue to me.
Arch actually has a large amount of official packages. Maybe some of the packages you’re referring to are just slightly renamed or alternate versions?
It’s possible that in some areas it has fewer packages of course (e.g. Debian might repackage a larger subset of PyPI as Python packages), but I need the AUR for very few things.
Isn’t the issue then that the official Arch repositories don’t have many packages …?
Not at all. The official Arch distribution has tens of thousands of packages and the user repository / AUR probably more than 100,000 .
Edit: I looked it up:
- According to distrowatch.com, the Arch Linux distribution has over 17,000 packges by now
- Meanwhile, the number of packages in the Arch User Repository is 114,000 .
Just because there is an official package doesn’t mean someone can’t make an aur one with the same name, or with common misspelling.
I haven’t been on my PC that much this week, just Friday night. And our D&D group uses Discord so I needed to make sure it was up to date to ensure it would run. I typically just do a, “sudo pacman -Syu” and that seems to update what I need.
If that is the only thing I did with the PC during this window, is there any concern?
Probably not. The article says that most of it seems to have come from orphaned stuff in the AUR that the threat actors took ownership of via the legit process, then modified to pull down malicious NPM packages when someone went to install them.
So if your Discord package is well maintained you probably have nothing to worry about.
Nah, you’re fine the Discord package(https://archlinux.org/packages/extra/x86_64/discord/) is in the official repo and it was not affected at all. The only people who should worry are those using AUR helpers to install packages without checking the PKGBUILD
A lot of people here seem to be under the impression that all of this effort should be abstracted for them
Wouldn’t this just make it harder to detect?
1500+ now https://md.archlinux.org/s/SxbqukK6IA
I was starting to get too confident in AUR. Thankfully I wasn’t affected. Just replaced all possible AUR packages to their respective Arch and Flatpak alternatives, with exception of very few or from the ones I had no option. But will definitely check before updating them, and will only install AUR packages as a last resort.
Have a look into the Guix package manager. It works fine on top of Arch, and Guix has 31,000 packages now. Great for cross-language development and also suitable for early sharing of projects. npm support is a bit weak though, but packages written in Python, Rust, or functional languages are well represented.
Thats like nix packager, right? Looks interesting to layer on top. Says they are all reproducible builds which is nice.
Yes, Guix is initially a clone of Nix and has still remains of shared code (the build daemon).
Differences:
- Guix packages are defined in a Scheme dialect called Guile, a nice minimal functional language
- Guix was created as a GNU project and stresses the importance of free software with strong copyleft
- strong focus on long-term reproducibility and capability of tracking the sources
- everything is built from source
- very good and well organized documentation
Tons of clawing at each other’s throats in the comments here, largely declaring one another removed for their use or misuse of AUR or thanking their lucky stars that none of their packages are on the list (so far), but not much that’s helpful for those less fortunate. Maybe nobody’s saying anything to that end because the article already covered it, but this is the second out of two times I’ve visited cybersecuritynews.com and been stuck in an “Are you a bot?” loop that never ends no matter how much of my browser’s safeguards I peel off.
Here’s what steps I did so far, based on following the links I found in this thread (especially the GitHub comments under one of the links):
-
pacman -Qmin console yielded a list of all the AUR packages that are installed on the system -
CTRL+F the results one-by-one in the apparent most up-to-date list: https://md.archlinux.org/s/SxbqukK6IA
-
I have one on that list, specifically
wine-nine, so I ranbat --style header,snip,changes /var/log/pacman.log | grep wine-ninewhich yielded the following (at the bottom of a very long list of apparent updates I’ve run since installing the OS):
[2026-06-05T20:37:06-0400] [ALPM-SCRIPTLET] wine-nine 0.10-1[2026-06-07T21:50:58-0400] [ALPM-SCRIPTLET] wine-nine 0.10-1[2026-06-08T20:56:54-0400] [ALPM-SCRIPTLET] wine-nine 0.10-1[2026-06-09T21:38:44-0400] [ALPM-SCRIPTLET] wine-nine 0.10-1[2026-06-10T21:58:52-0400] [ALPM-SCRIPTLET] wine-nine 0.10-1[2026-06-12T20:18:37-0400] [ALPM-SCRIPTLET] wine-nine 0.10-1[2026-06-12T20:18:37-0400] [ALPM-SCRIPTLET] wine-nine 0.10-1(Like a good little Arch user I’ve been updating pretty frequently)
- Now what?
I saw something that said “check for suspicious processes running as root” but I have no idea what that would look like.
I saw something that said I need to redo all of my passwords and tokens. Any way to check if that’s necessary or should I just assume I’ve been pwn3d?
In using
pacseekI think I’ve discoveredwine-ninehasn’t been modified in the AUR since “2024-12-07 - 15:18:31 (UTC)” so can I relax a bit? I’m currently going through my list of AUR packages and deciding whether or not I need them as badly as I originally thought. Sadly my distro is one of those that decided to lean on AUR, because most of my list (apart from two) I don’t recognize as something I’ve installed myself.
pacseekwould not let me remove the following AUR packages (which thankfully are not in the list (yet))::: removing electron41-bin breaks dependency 'electron41' required by deltachat-desktop- an encrypted chat application I installed (not via AUR) I suppose I could find an alternative for:: removing electron41-bin breaks dependency 'electron41' required by freetube- a YouTube frontend I installed (not via AUR) I suppose I could find an alternative for:: removing libsoup breaks dependency 'libsoup' required by webkit2gtk- no idea whatwebkit2gtkis
I only just now realized that chaotic-aur is probably just as problematic as AUR, both in my decision to use packages at all as well as my searching the list of compromise packages, yes? I have tons more packages under that, most of which I think came with the OS.
Chaotic is not just as problematic, thankfully. They have systems in place to flag suspicious changes for human review before letting them out and it has, so far, prevented them from shipping any compromised updates.
I thankfully hadn’t updated anything from the AUR for a couple of months (it doesn’t happen by default when I update the rest of my system) and was unaffected, and after looking at the list of things I had from the AUR, I didn’t need any of them… So I now have zero AUR packages on either of my systems.
-
Not even having npm installed as a system package feels like a personal win right now. I’d like to think I would have caught this due to the number of dependencies it would introduce to my system. node_modules seems like it’s been the source of most of the recent CVEs I’m hearing about.
I develop inside docker for this reason too
Pnpm for the win
Look how every motherfucker complains about arch and the aur but not that their distros blindly use it without contributing back and even suggest to blindly trust it. these same people now complain the aur is to complicated. Never go full removed guys
Wow, I have 229 AUR packages installed but none of them is on the infected list!
Am I just lucky?
I have 229 AUR packages installed
Holy shit lol…
I just checked the new list with 1937 infected packages, not a single match. Again, am I just lucky or are all these 1937 packages barely used by people?
Check again, it’s around 1500+ packages now.
I just did. Still no match. I guess still have some luck left :)
How do you guys check against that list? Especially when people have so many aur packages. I simply searched the list for each package manually but I only have 5. Do you write scripts?
So far I’ve just checked the diff of every package update. But with that many, I think we should maybe start using using the script provided in the article that you evidently didn’t read.
I read another article before which did not mention the script but only listed all affected packages. So yeah I should read this article :)
typical arch user, doesn’t know how to use grep.
i have a few machines and lots of aur packages and none of mine have a single hit either
Same here. Just checked against the new list with 1937 packages and still don’t have a match.
can i get a link to the list youre using, or where you found it?
Yeah I had a mild panic before realising that I haven’t actually used aur for anything yet
I only ever access the AUR in an Arch distrobox… The containerization should protect me right?
Nope. Distrobox does not offer any meaningful protection, since its purpose is to integrate with the system. It’s basically meant to make downloading and managing packages from different distros, on the same system, much easier… but it’s not meant to protect and isolate your device the same way that Flatpak or other type of containers do. That baing said, stop relying on Distrobox as a safety measure, and check your recently installed and updated packages since 9th June, to make sure you were not infected.
Oh well… I only have one AUR program installed anyway and it ain’t on the list
Absolutely not
So, I’m totally fine because I always manually install from the AUR? This is more of a problem for people using those AUR helpers that make a package manager out of it, right?
I don’t think it matters how you installed infected AUR packages.
No. If it came from AUR, it doesnt matter the method you used. You should check all the AUR apps you recently updated (from 9th to 12th June), and compare it to the lists. Only AUR though… Arch official repos are not affected by it.
Another win for Windows
What was there other win?
Win32 and win64 I think
Windows 98 Second Edition
Expecting user to inspect install scripts is removed. And this is the result.
So what would the alternative be? If the resources or desire don’t exist to make a package official, how else would you install it?
You’re missing the point entirely. I’m talking about inspecting the scripts not about making packages
Sorry if I was unclear. You usually don’t inspect the install scripts for official packages since you put the trust in the official team. You don’t trust(or at least shouldn’t) AUR packages, hence you should inspect the install script for those packages. I don’t really see what the alternative would be.
Well, the alternative would be for moderation team to inspect them, with clear signaling of which scripts are trusted and which aren’t.
But this is exactly what the top comment of Cease talks about: There is no moderation team. You seem to think that it is the job of the maintainers of the Arch Linux distribution is to vet and review the AUR packages. But they take care for the - much more widely used - Arch distro packages and are busy with this. They have enough to do. And the AUR packages are not part of the Arch distro.
The AUR is basically a server where users can store their own packages so that others can use it. As its name says: Arch User Repository.
There is no moderation team.
And that’s why it’s fundamentally shit idea on so many levels. Instead of having one person to inspect let’s make every single user expert or not to inspect every package each individually. This is fucking removedation at its finest.
But who would do that? Do you have security expertise and are volunteering to do that?
The option is to not have it
ahahaha such a shit take
There IS one person that inspect the code for everyone, that’s the package maintainer. But it’s a random voluntary contribution from some random person who you should not blindly trust. That’s the point of the AUR, one person makes it significantly easier to install for everyone. The point is to be better than installing directly from somewhere like GitHub. For actual good moderation there are officials repos
if you dufus can’t read a pkgbuild DON’T USE THE AUR might also keep the shell closed
Then dont use arch and the aur easy as that
Sounds like something a fedora user would say.
Are you aware how github works, or open source development in general ?
Some users are developers, too.
Some people write code, others may try it out, and a few of the latter might help with developing it. And some of these efforts become popular.
That’s how we have Linux or KDE.
That’s why Sourceforge was such a big win, why Ubuntu has launchpad and ppas, and why Arch has AUR.
It is all based on open sharing.
And of course you can opt to not run code that you don’t know, or don’t understand , or don’t trust.
Ha! Infosec has been telling us to update out software frequently because it’s safer. My strategy of bone-idleness and updating only once a monþ or two is looking pr-etty smart.
That’s not how that works.
- when you use distribution-provided packages, you trust the distribution maintainers
- when you use the AUR you trust the upstream project and check the PKGBUILD because the maintainer can change
In some cases, upstream also maintains the AUR package, in which case you can probably trust that it’ll not be abandoned
It was a joke.
Welp, you wouldn’t be the first who actually believes what you wrote!
On the internet, nobody knows you’re a dog.
Edit, for clarity: what I meant to say was: little blobs of text are really lacking in communication nuance.
Hahaha I’m old enough to get that one, but I’m sure there are zoomers going “tf they’re talking about dogs now”
Dogs, are not, I am absolutely not a swarm of bees. I wobble around on my two meat sticks just like oþer humans.
