Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware
(www.phoronix.com)
LinuxThe AUR is basically just a shortcut for downloading random shit off GitHub.
It gives un-experienced users a false sense of security.
At this point, the count stands at 1500+ https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
How do I check if a system has been affected most easily? As far as I have seen it's related to the npm package atomic-lockfile, so would that be enough?
npm ls atomic-lockfile
Maybe maintenance of packages shouldn't just be handed over to newly created accounts. This is a design flaw on AUR's part. As Linux popularity rises, these types of attacks will just keep growing. There should also be some sort of system where it is easy to verify that the maintainer of the package is also the actual developer. Like brave-bin has brave has the maintainer who are also the creator. Just give a green check mark to them or something.
"No way to prevent this" says only repository where this regularly happens
I learned 10 years ago not to use aur helpers because they hide the sources. Aurutils + vifm baby!
AUR
Whelp...I've REALLY loved EndeavourOS for my laptop, especially because I felt I could mess around with stuff, but maybe this is my call to use something like Fedora or a OpenSUSE variant (I love Tumbleweed dearly).
Nothing against the incredible Arch, but I'm deffos that user who does
> yay
> "Build files exist. Do clean build? N"
> "View changes? N".
ENTER.
I want to learn, but also I'm a bit of a danger to myself if this malware threat is this broad.
Opensuse is great, been daily driving it for 1.5 years with no issues (issues were solved by booting an old snapshot and rolling back, updating again 2d later)
Have you heard about the recent fuckups of fedora? fedora is a shitshow.
If you just yolo with yay anyway, you will get compromised on any system you use, ni matter the OS or distro, my dude.
Have you heard about the recent fuckups of fedora? fedora is a shitshow.
Oh really? I guess I haven't. 😬
Yeah it was late here so I think I was poorly mushing two separate thoughts together there. I meant I was thinking of moving to a distro that isn't as bleeding-edge for the laptop I'm not updating every single day...But also I should find something that still has a nice large software variety so I stay off AUR.
OpenSUSE has the "Open Build System" which I've used for like one package. So that's pretty neat.
This is really tough because I have two gamers in the family using Nvidia cards I want to help move off of Windows, but I don't want them running into having to roll back as often as I have or fiddle too much, but I feel like Mint is a little too far behind.
So I was considering the KDE spin of Fedora for them...But yeah, the answer isn't so easy anymore lol.
Useful list for those who do use Arch; I've only got like two things from AUR and neither is on that list (although I kinda recognize a couple with slightly different names, like what, knock off plugins for official stuff?)
I got yesterday an email how one of the packages from this list that I used to maintain was adopted.
the AUR ideally should have a dedicated team of moderators of packages round the clock but archlinux is a community distro, and you really shouldn't trust the AUR implicitly and treat it as literally downloading stuff from the internet through search because that's what it does most of the time.
I do use AUR though, and only one (obs-studio-liberty) is not endorsed by the programs I use from it
Do you even read the pkgbuild files you DL from the AUR?
yeah
Ahh clearly Arch users didn't RTFM before installing shit. Skill issue.
PS: The above is an invitation to self-care, not an insult.
I must say, Read The Fucking Manual is a bit more clear than Read The Friendly Manual.
I disagree with the post you put here on a single thing: the manual is sometimes bad, by either not describing everything, or being unclear.
Best not to read any then, if it might be bad.
I've seriously gone through manuals in languages foreign to me and still learnt something from it.
My partner doesn't and will only use the basic features of tech. I read the manual, and I'm suddenly a wizard because I got two Bluetooth speakers to pair with each other and get stereo from them.
Is that worse than not reading it at all? Often it is a lead to something more useful
You know what? You're right
Reading the manual clearly won't help with the issue here. This is clearly not an appropriate use of RTFM terminology here, because it does not apply. The problem here is not that the user needs to read before asking for help. The problem here is to understand the changes made in the script are malicious. And reading the manual won't help with that.
As an user of the AUR, this is devastating news to me. I am also guilty of accepting updates without reading the latest changes, even if yay asks me if I want to. This is a reminder to everyone to only install from the AUR for absolutely necessary stuff only, and only if you trust the maintainer. And to at least have a look if something suspicious is going in with the recent changes in the package recipe. AND to read in the communities and news.
I don't understand why there still no official announcement as a warning from the Archlinux team at https://archlinux.org/news/ . Is there a different place for security news specifically about the AUR to subscribe to? EDIT: https://archlinux.org/news/active-aur-malicious-packages-incident/ They did it, an official message.
EDIT: https://archlinux.org/news/active-aur-malicious-packages-incident/ They did it, an official message.
I wish they'd actually explain their findings/attack vectors so that people have a chance to stay ahead of this by reading the PKGBUILDs as recommended.
This is a reminder to everyone to only install from the AUR for absolutely necessary stuff only, and only if you trust the maintainer.
Unfortunately not foolproof either. I have no infected packages that I know of because I happen to be on a new install, but I caught wind of the LAST AUR botnet infiltration and switched to flatpaks or source builds. Since then I drifted back to AUR for convenience. I thought I was being clever only using AUR packages when I could be "sure" the author of the original software package pushed to AUR, and this was easy since devs who build on Arch typically recommend AUR whether they maintain the package or not. Today I found out spoofing package ownership is apparently easy and so is spoofing git credentials.
I was on Endeavour and it was incredible, but I'm not That Power User and I feel like part of the problem. The worst part of all of this is its owing to an influx of users who want the same ease of use they used to enjoy, but in Windows SOP is installing whatever the fuck you want on Internet Explorer and bugging your sysadmin to fix whatever happens. Its probably really hard to be any kind of FOSS developer right now.
Yes, definitely not foolproof. This is more of a wake up call to be at least careful and reconsider every single AUR package one has installed. For me, I was lucky too. But in my case it wasn't pure luck that the few AUR packages I have installed aren't affected. See, because since years using the AUR (sparingly! including my own package :D ) I always feared off orphaned packages and removed them as soon as I could. This incident here is proof I was right.
For some stuff I also prefer the Flatpak, because I do not trust everyone on the AUR, as they operate on root rights! When I brought this up on Endeavor, they disliked my opinion (as a fresh user) and the trusted community members there explained to me that the AUR is way more safe than Flatpak, because there is a trust system of upvotes and everyone can flag the packages, and that Flatpak has a wrong sense of security. That is what they told me and totally ignored my issues with AUR... one of the reasons why I do not visit the EndeavourOS community... I digress...
The fact that the Arch maintainers seem to prefer Reddit over their own fucking news channel is what made me switch from Arch years ago. I got sick of upstream breaking changes fucking my system because they wouldn't notify people through official channels, only to find it later on /r/archlinux 🙄🙄🙄
since the 2022 grub incident, Arch has done a great job at notifying the news channel when "manual intervention required" AFAIK, and I don't remember any instances of Arch maintainers only notifying Reddit (and I don't think they notified Reddit for the grub incident either lol).
It's been 4 years already? WTF?
They made an announcement though
What are you using now?
After the end of Win10 I moved to arch but I think my week end will be filled with moving again. ^^
On my desktop, CachyOS 💀
It was years ago when Arch pissed me off, but I couldn't resist Arch-based distros forever. So far, I haven't been burned.
On my laptop, Asahi Linux, which is basically Fedora ARM with a custom kernel. I'd recommend Fedora to most general users.
the arch news channel is for breaking changes to arch pacakges (so not the AUR) only. maybe you could subscribe to aur-general@lists.archlinux.org.
They are actually putting a message on the regular news feed about the AUR! https://archlinux.org/news/active-aur-malicious-packages-incident/ As it should be. It just took a bit too long in my opinion, as discussions are going on since yesterday.
I was hoping to subscribe with RSS. Not sure how to subscribe there.
it's a mailing list, so heads up, if you subscribe you're also gonna get other discussion like the forums.
https://lists.archlinux.org/mailman3/lists/aur-general.lists.archlinux.org/
Dang, if only their packages were more up to date maybe this wouldn’t have happened.
There were announcements and security ping in the arch Linux community discord... But I wish they'd be more vocal on this outside discord especially given discords controversy as of late
Thee's a official Arch Linux D*scord?
No it's unofficial but it's I believe the biggest/primary arch Linux community discord .
In their roles chanel you can pick one to get security pings.. major ones are typically also everyone pinged but some have those disabled
You'll pry #archlinux from my cold dead hands
AUR
Play stupid games win stupid prizes I guess.
Wow that’s bad 🫢
Least surprising thing ever. Nothing is reviewed or approved, not even proforma
(btw)
GOTDAMN
(hopefully this doesn't read as blaming the victims instead of the attackers but) I personally don't think it's that complicated to read the updates to AUR packages. It's not any more hard than only commenting after reading the links that people post here instead of just the headlines—which we all do, right?
I don't think it's immediately obvious that the PKGBUILD installing some shit with npm is malware.
i wouldnt know where to get the info in the first place. when i use windows update i also dont reed any changelog because that shouldnt be the users job but the suppliers
As an avid user of the AUR, you'd be correct if you were downloading from the official arch repository. But you aren't. AUR is basically like downloading from github. The only "guarantee" you get is from whoever put the package up and its up to you to determine if they're trustworthy.
The whole point of the AUR is that it's just random people's code. There is no supplier here. If you don't know where to find that information, you really shouldn't be using AUR.
In an ideal world yes, but I needed some software that was only available via AUR and if the official guides tell me I can install it via AUR I will.
