AUR Packages Compromised with Infostealer and Rootkit

(discourse.ifin.network)

86 points | by keyle 6 hours ago

13 comments

  • spystath 35 minutes ago
    Obviously installing anything from AUR must be done cautiously and there have always been sketchy (as in improperly built/packaged) packages in the past but seeing actively malicious injections is concerning. I think there are two main problems with AUR: 1. it is a remnant of a slightly more egalitarian era in the open source history when you could generally trust 3rd party code and 2. orphaned packages can be adopted by anyone with their full history and vetting intact.

    I think we are well past (1) but (2) could be mitigated by tighter controls on AUR accounts and potentially additional safeguards from AUR helpers. Maybe show a big scary warning if the package has changed owners recently. I know there will still be people that will "y" their way forward but it's better than nothing.

    Or just avoid AUR helpers altogether and inspect/build the packages you need yourself from their PKGBUILDs directly.

    • jeremyjh 4 minutes ago
      There was never an era in which #2 was a reasonable policy.
  • xx_ns 11 minutes ago
    This campaign is still ongoing. I just got an email that one of my old packages (which hasn't worked for years and was orphaned for a while) was adopted and immediately a malicious commit was pushed. They seem to be using bun instead of npm now, so any npm-based workaround likely isn't effective.

    https://aur.archlinux.org/cgit/aur.git/commit/?h=toggldeskto...

  • Retr0id 1 hour ago
    I haven't used Arch for a few years now, but when I did the AUR was my favourite aspect.

    It was never perfect from a security PoV, but in 2026 this kind of trust model feels increasingly scary.

  • UI_at_80x24 2 hours ago
    Here's an easy script to scan for compromised packages:

    https://cscs.pastes.sh/aurvulntest20260611.sh

    Not my script. It's easy to read/parse. Never pipe a script directly to bash.

    • sph 1 hour ago
      A quicker alternative:

        comm -1 -2 <(pacman -Qq | sort) <(curl -s https://gist.githubusercontent.com/quantenProjects/3f768dce7331618310f016d975bf8547/raw/beef579f8a8efeed6ccf60788e5b768775550095/packages | sort)
      
      It's never a bad time to learn about comm(1).
    • sva_ 1 hour ago
      It isn't guaranteed that the list is conclusive.

      Always check PKGBUILD and sources, AUR is not to be trusted for the most part. I'm actually more surprised that such compromise hasn't happened earlier.

      • datakan 9 minutes ago
        > I'm actually more surprised that such compromise hasn't happened earlier.

        This is like the 3rd or 4th time. It's been ongoing and persistent for the last 2 years with frequent AUR downtime as a result.

        The AUR should be deprecated in its current state, simply can't be trusted and is a blemish on an otherwise great distro.

      • matheusmoreira 1 hour ago
        The Arch Wiki does note that malware has made it into the AUR several times before.
  • secret-noun 41 minutes ago
  • nialv7 1 hour ago
  • keyle 1 hour ago
    More news is coming out about this:

    https://www.phoronix.com/news/Arch-Linux-AUR-400-Compromised

    I toyed with the idea that someone should write a binary that simply emails, or alert you when it's been run... as a canary... and call that `npm`.

    At this point, not renaming the npm binary is a big risk.

  • lordleft 1 hour ago
    This is especially gnarly as more people have been picking up arch distros as of late (like CachyOS).
    • scary-size 1 hour ago
      Installed CachyOS to replace my Win 10 installation a month ago. Not looking back! But yeah this sucks, I've mostly used Ubuntu with apt in the past. Pacman and makepkg felt a bit weird to use in the beginning.
  • sph 1 hour ago
    Be aware of false positives! I found I had two of these packages installed, clang19 and compiler-rt19, but due to my recent laziness in updating my system, mine were still the versions from July 2025 from the official repos before they had relegated them to AUR.

    You can check the build and install date with `pacman -Qi <package>`.

    I run Arch Linux in a container (within Fedora Silverblue), but my plan for the future:

    - consider switching away from Arch Linux for my dev container, with great sadness. A rolling distro is a terrible idea in the current security climate. I loved using Arch for my dev container exactly because of AUR.

    - switch to Fedora Stable, perhaps the previous release which still gets security fixes but no other updates. I am still on Fedora 43, I guess I have no rush to update to 44. - be even lazier in updating my workstation. I used to update daily when I was running Arch, then I moved to weekly last year when I got stuck with slow internet, now consider updating monthly or more (of course, unless there are critical security bugs)

    - Flatpak and Flathub terrify me, it's only a matter of time until malware appears. I have had automatic upgrades disabled for a while.

    - for the love of God don't touch anything that uses npm

    Previously: https://news.ycombinator.com/item?id=48458931

    • reedlaw 21 minutes ago
      I also had an affected package installed, fortunately it was from the official repo before it was dropped and became an AUR package.
    • doubled112 6 minutes ago
      > Flatpak and Flathub terrify me

      I thought Flathub has a review and approval process. Does it fall short in some fundamental way?

      Any review process is more than the AUR and NPM are doing.

  • self_awareness 41 minutes ago
    How a person 'adopts' 408 packages and controls their build scripts?
    • Technetium 20 minutes ago
      They were orphaned, so anyone could adopt them. There are 15k other orphans at the moment.
  • virajk_31 1 hour ago
    AUR doesn't guarantee security, its upto the user to use AUR & verify before installing anything, its very evident why arch is not used in enterprise solutions.
    • fooqux 1 hour ago
      It's not the AUR. It's the rolling release cycle, and probably even more importantly, lack of support options.
      • datakan 8 minutes ago
        The AUR has absolutely nothing to do with the rolling release cycle
    • hootz 1 hour ago
      Arch is not used in enterprise solutions because of the AUR? Can't you just not use it?
      • virajk_31 1 minute ago
        AUR is choice, rolling release is the reason
  • QuantumNoodle 1 hour ago
    Man, I never hear good security things about npm
    • Retr0id 1 hour ago
      This doesn't really have anything to do with npm.
      • notabotiswear 50 minutes ago
        From the Arch mailing list [0]

        >The result is a rather long list of ~408 packages all doing npm install atomic-lockfile something something

        [0] https://lists.archlinux.org/archives/list/aur-general@lists....

        • Retr0id 34 minutes ago
          They could've pip installed, curl|sh'd or anything else, it's not relevant to the underlying issue.
          • notabotiswear 7 minutes ago
            Perhaps there were other vectors, but npm was the one used here.

            And yes, this is an AUR issue, but npm being used to host and dissiminate malware is also [a chronic] one, even if separate.

      • vitamark 56 minutes ago
        anything except that it's malware installed via npm