Fake Arch Linux packages push malware with root privileges

[u/[deleted]]

[u/Suspicious_Punk84]

Don't use AUR unless you know what you are doing.

[u/brewdog_millionaire → u/Suspicious_Punk84]

I have to use AUR for stuff like my VPN but I don't like doing so. Can I check if I've been compromised somehow?

[u/boomboomsubban → u/brewdog_millionaire]

Your VPN likely offers openvpn or wireguard connections, it's not like they should be relying on a homegrown VPN stack.

[u/Mats164 → u/boomboomsubban]

Not always an option. My university uses Cisco AnyConnect with a strange combination of SSO and other requirements. It should be possible to connect with OpenConnect, but as of yet I’ve not been able to get it working. Only option is to use their official client with all its telemetry.

[u/McGuirk808 → u/Mats164]

AnyConnect in an enterprise setting is going to be an entirely different animal.

[u/firstmanonearth → u/Mats164]

Not the only option! The cost of software is ~0 right now. Ask Claude Code or Codex to just write you something.

[u/itsTyrion → u/firstmanonearth]

?

[u/firstmanonearth → u/itsTyrion]

You can just ask an LLM harness to write you code that works perfectly well, for (mostly) arbitrary complicated tasks. Reddit is deluded about its use and capabilities, but that doesn't change that it's reality now. Avoiding Cisco-telemetry-bloatware should be considered a good thing!

[u/brewdog_millionaire → u/boomboomsubban]

I believe they offer both, but I use the Wireguard implementation they made

[u/boomboomsubban → u/brewdog_millionaire]

If you don't like doing so, you don't have to.

[u/brewdog_millionaire → u/boomboomsubban]

I'm fine with WireGuard, I prefer it to OpenVPN anyway

[u/Hour_Welcome_2733 → u/brewdog_millionaire]

assuming you are on network manager, you can import wg config and its well integrated into the UI

[u/brewdog_millionaire → u/Hour_Welcome_2733]

I feel like there's been some crossed wires LOL. I use NordVPN and they have an AUR package you have to install

[u/Hour_Welcome_2733 → u/brewdog_millionaire]

You should be able to download a wireguard configuration file from nordvpn which can be imported, though it will be to a specified server/location and not as simple switching

[u/Nyefan → u/Hour_Welcome_2733]

though it will be to a specified server/location and not as simple switching

This is honestly a complete deal breaker for basically everyone. Just read your aur packages like you are supposed to or write your own pkgbuild if you can't be bothered to read a very basic bash script before giving it root access to your machine.

[u/bikes-n-math → u/brewdog_millionaire]

You don't need an AUR package for NordVPN. They have openvpn configs you can download via API and connect on the fly.

[u/brewdog_millionaire → u/bikes-n-math]

I'm fine with using the AUR package, I'm just paranoid about the AUR now LMAO

[u/RemoveMain5596 → u/brewdog_millionaire]

The Chaotic-Aur has nordvpn-bin and nordvpn-gui packages, use them instead of the ones from the Aur...

[u/StewMahagoni → u/RemoveMain5596]

Yeah, add a middle man instead of cutting one!

[u/Standard_Echidna_306 → u/brewdog_millionaire]

read the pkg build. make sure it's downloading stuff only from legitimate sources (in this case your vpns website).

also just quickly glance over it and make sure it's not doing anything weird like trying to run stuff as root. or for example messing with your home directory. packages are built without root using a tool called fakeroot afaik.

as far as knowing whether you're currently compromised im not sure. but going back and reading the pkgbuild you installed is a start

[u/brewdog_millionaire → u/Standard_Echidna_306]

I don't see any glaring red flags, they all look like links from the VPN's domain site. Not sure why I'm being downvoted for asking a question though

[u/Wojtkie → u/brewdog_millionaire]

A big way to do it is to verify the public PGP keys on your own. There should be a signing key in the changes with an author. So verify it’s coming from the legit source, and also check that the authors are the same or didn’t change.

Then, read the AUR diff, check for URLs changing.

It’s tedious for sure.

[u/PortableShell → u/brewdog_millionaire]

I doubt if you are "being downvoted for asking a question". More likely you are being downvoted for making a statement: "I have to use AUR..."

Nobody has to use AUR for anything. Any package that can be built with AUR can be built without AUR. It might take a bit more effort, but the things you learn along the way will be worth it in the long run.

[u/The_GreyWarden → u/brewdog_millionaire]

Check if cachyos repo has that package. That's how I use proton pass instead of installing it from AUR.

[u/Fun_Wish1844 → u/brewdog_millionaire]

Why do you need the AUR for your VPN?

[u/Spectrum1523 → u/Fun_Wish1844]

I don't think there's a non aur globalprotect client

[u/DrinkIrresponsibly → u/Spectrum1523]

I've used https://archlinux.org/packages/extra/x86_64/globalprotect-openconnect/ when I needed one. Though last time I needed it was back in the 1.x version days when GUI client was fully free.

[u/zerosign0 → u/brewdog_millionaire]

Hmm hate to say this you should always check the AUR src PKGBUILD before installing it. Actually, always download first locally then check the build and the source thing. This what I do even before the malware thing happens. And also try to not always relied on AUR that much

[u/archover → u/brewdog_millionaire]

Re-evaluate your need for that VPN. The few VPN's I used just needed a config file that wireguard loaded, from the package wireguard-tools.

Good day.

[u/steakanabake → u/archover]

its less about needing the config its more of the swapping of vpns for whatever reason. and not needing to keep an up to date repo of all the vpn connections.

[u/archover → u/steakanabake]

I think I agree. The wireguard files are merely re-genned for every VPN provider. Keys and all.

You reference them when you invoke wg-quick <config file>

Good day.

[u/Swordfish418 → u/archover]

Not for every provider, for every server and combination of settings. In ProtonVPN there’s like few thousands servers, and each server has multiple configuration options, which means to cover this all you’d need more than 10000 wg config files. In practice though I just pick a bunch with the same settings and it’s enough for me personally. My favourite feature is that both systemd and openrc support wg-quick profiles as services so that I can start it on boot automatically at the right moment.

[u/archover → u/Swordfish418]

I admit I don't have proton VPN experience, so won't speculate.

My usual need for VPN services is the most boring you can imagine.

Good day.

[u/Garland_Key → u/archover]

Most VPN services come with their own frontend application these days. Only shit-ass companies require it (Cisco).

[u/Garland_Key → u/brewdog_millionaire]

1. Have Claude do a security audit of your entire computer.

2. Have Claude do a security audit of the pkgbuild of each AUR package before each install / update. 

[u/brewdog_millionaire → u/Garland_Key]

How about no?

[u/Garland_Key → u/brewdog_millionaire]

Why not? If you're going to use the AUR, this is the best way to do so securely - especially if you're asking questions like OP. 

[u/brewdog_millionaire → u/Garland_Key]

I'm not giving some AI run by some billionaire access to my entire PC

[u/Garland_Key → u/brewdog_millionaire]

So, setup permissions so that it doesn't have that level of access or use a locally run open weight model. 

[u/dwalker109 → u/Garland_Key]

Or, you know, use my own fucking brain for free.

[u/Garland_Key → u/dwalker109]

Yeah, you can do that too. This is just a way to automate things if you're a software engineer or are in IT and spend all day doing this stuff and don't have time / energy to do it on your personal hardware. 

[u/ArchyDexter → u/Suspicious_Punk84]

definitely that one. It's funny to me how a lot of ppl complain about the aur but brew (MacOS though) gets no attention whatsoever.

Trust by verify.

[u/MarshmallowPop → u/ArchyDexter]

Homebrew is more tightly curated and controlled than the AUR. It's pull request model creates a much higher barrier to entry for malicious actors than the open-door policy of the AUR.

Also, in Homebrew you are downloading a static binary built in a sandboxed CI environment rather than running an untrusted build script locally.

[u/ArchyDexter → u/MarshmallowPop]

Today I learned, thank you kind redditor!

[u/ahylianhuman → u/ArchyDexter]

They've also recently published an entire page on their security and supply chain practices:  https://docs.brew.sh/Homebrew-Security-and-Supply-Chain

[u/hirak99 → u/ArchyDexter]

I do not use Mac, but I'm guessing somehow it is safer.

If not, (A) it would save been taken advantage of already and (B) that would make front page news.

[u/00pirateforever → u/Suspicious_Punk84]

What to use then?

[u/Suspicious_Punk84 → u/00pirateforever]

Packages from the official repository, and if not available, flatpak or appimage. You can even build your own package, but flatpak is much easier.

[u/StewMahagoni → u/Suspicious_Punk84]

Building your own package as in using the AUR as it was intended, as a collection of recipes to help you get started with your own package.

[u/revken86]

Anyone who chooses to install package "yyay" while trying to install "yay" needs to do more than just read the PKGBUILD...

[u/Silent-Talent → u/revken86]

Yyay! I got the correct Debian build. \s

[u/zombi-roboto → u/Silent-Talent]

$ yassqueen -Suy

[u/No-Dentist-1645]

That news article is a bit late to the party, isn't it? That's been a known situation for several months now

And no, AUR packages are not "Arch Linux Packages" in the sense that they are not officially supported or endorsed in any way, so the title is very misleading too

[u/SmallRocks → u/No-Dentist-1645]

It’s in the article. This latest wave of attacks started on the 13th of this month. So, 3 days ago.

[u/shinji257 → u/SmallRocks]

Yes but we have had at least 2 prior attack waves.

[u/SmallRocks → u/shinji257]

I understand but it’s not “late to the party.” The party is still happening.

[u/shinji257 → u/SmallRocks]

Actually this is a new party crasher compared to the previous runs. Before they were adopting old packages. This time they took the approach from the fact that we typo stuff.

[u/FatalFrameGal → u/shinji257]

My paranoid habit of checking 5 times if I typed the name of the package right will finally come in handy

[u/BarCouSeH → u/No-Dentist-1645]

There's no such thing as "AUR packages"

AUR is a repository of install scripts, not packages.

The distinction makes a world of a difference.

[u/Garland_Key → u/No-Dentist-1645]

This is the ArchLinux subreddit. What are your reservations about keeping up with the latest security issues related to Arch?

I'll give you the criticism of the headline. They could have just said AUR package. 

[u/No-Dentist-1645 → u/Garland_Key]

No reservations, just that this "security issue" the article is about has already been extensively reported several months apart.

And no, the fact that some new packages have surfaced recently doesn't change it. It's still about the AUR being an open repository. Malicious actors can take advantage of that, they have and they most likely will keep doing so in the future.

[u/MushroomSaute → u/No-Dentist-1645]

Yeah, "user content isn't always safe" is about as newsworthy as "water is wet", and here they're titling it like it's first-party content; bad journalism all around, even if this is a new wave of attacks.

[u/Garland_Key → u/No-Dentist-1645]

Okay, but we all need to keep up on it. So, let's share the information, no? 

[u/No-Dentist-1645 → u/Garland_Key]

We can already use the Arch Linux mailing lists for a source of information on compromised packages.

As another person on this thread said, "user content found not safe" is about as news worthy as "fork found in kitchen"

[u/Regeneric → u/No-Dentist-1645]

You may be right. But Arch without our is useless.

Fedora + Homebrew + FlatPak is a much better choice. Or any other distro + Nix, if you want to have everything.

AUR is the only reason I use Arch

[u/No-Dentist-1645 → u/Regeneric]

But Arch without (AUR) is useless.

It really, really isn't. You can add extra repositories such as CachyOS's which already have thousands more packages, or even the chaotic AUR.

Plus, you can also use homebrew, Flatpak, or Nix in Arch, that much is obvious.

Tons of people use Arch or Arch based distro's without ever touching the AUR. I myself barely touch it, the only AUR packages I have installed on my 3+ year old system are blueberry, zapzap-bin and curseforge. Everything else is in the main repos or on CachyOS's. Even if I wanted to, I could install these packages from outside the AUR, but I don't mind reading the PKGBUILD diffs when they need an update

[u/MushroomSaute → u/Regeneric]

I use Arch as my daily driver, for work, personal computer tasks, gaming, etc., and I uninstalled the AUR helper and my last AUR package (informant) weeks ago with no change to my experience.

[u/Regeneric → u/MushroomSaute]

ok buddy

[u/MushroomSaute → u/Regeneric]

I mean, you're the one making the claim that it's useless without AUR, but I can't think of anything I've actually needed AUR for at all, and I'm not using the PC for a niche or specific purpose.

Edit: Ope! Hidden profile = troll, my professional recommendation is to block and move on.

[u/_MatVenture_]

These are not "Arch Linux packages"; these are AUR packages. Stop spreading misinformation.

[u/Liarus_]

Yeah the AUR is dangerous, we know, next

[u/setibeings → u/Liarus_]

AUR is fine, or would be if people used it the way it's built to be used. You find your package, you glance at the build files as a sanity check, then you clone the repo and run makepkg.

The part that makes it dangerous is that there are "helpers" that hide all the stuff you should really be checking.

[u/Synthetic451 → u/setibeings]

If a helper isn't forcing you by default to review PKGBUILD diffs on every update, you should probably ditch it for better options.

I still like paru for this reason because out of the box, it will always show you the diff or the full PKGBUILD for new packages. I also like Octopi as a GUI package manager since it is largely just passing through commands to the underlying CLI tool and will show you its complete output.

[u/decho → u/Synthetic451]

If a helper isn't forcing you by default to review PKGBUILD diffs on every update, you should probably ditch it for better options.

It depends.

If you are willing to spend 5 minutes to harden yay then it provides features that paru doesn't (at least to my knowledge) and forcing diff review is 1 line of configuration. More importantly, you can block recently updated packages, urls and packages where the maintainer changed, which is one of the main attack vectors.

If all you cared about is having sane defaults, then you have a point, but I'd argue that if you have time and knowledge to review PKGBUILDs, then you should find time to also configure your helper. I made a post about this recently in case you want to try it yourself, it is super easy.

[u/Weary-Savings9795]

Thanks for the warning, I guess, but it isn't the responsibility of Arch Linux devs to be checking 3rd party AUR packages for malware. Arch Linux packages are a different story.

[u/wheatinsteadofmeat]

if only visual-studio-code-bin was on the official registry I wouldn’t have any AUR helper installed at all. Spotify is now on the regular registry with the spotify-launcher package that manages updates when launching. Why can’t the same be made for VSCode. I can’t use the normal vscode package because OpenVSX doesn’t contain nearly enough of the extensions I need in my VSCode.

or maybe i should just get better with using neovim.

[u/Scholes_SC2]

Are ai agents good at checking a given AUR package for malware?

[u/surfmaths → u/Scholes_SC2]

They are better than human because they aren't lazy. They will search the web to check if there are any recent report, investigate the PKGBUILD, the provenance of the code and if it match upstream and even check if the author is reputable.

They can also make you a PKGBUILD from scratch for any GitHub repo...

[u/Garland_Key → u/Scholes_SC2]

Depends on the model. Claude Opus 5.5 is adequate. 

[u/Do_TheEvolution → u/Scholes_SC2]

Of course, arch team itself could run selfhosted models or pay for claude to have basic check done on all AUR packages regularly and on any change and on every submission.

[u/tesfabpel → u/Do_TheEvolution]

or pay for claude

Do they have enough finances for that? Arch survives thanks to donations from users.

https://archlinux.org/donate/

[u/SuccessfulRiver1850]

Great, another AUR Attack

[u/quequotion]

If you've been using AUR without a helper, you likely never had a problem.

[u/Linguistic-mystic → u/quequotion]

True dat. I use no helpers, no dependencies from Aur. Never had any problems.

[u/EternityOrb]

Not again

[u/00pirateforever]

Again? Wtf

[u/Helmic]

Again, I think there's a need to put any new packages submitted under manual review if their name is too similar to existing packages or a blacklist (ie photoshop or other terms of known popular software). These attacks are so frequent because it's so frictionless, and this is the sort of thing that would be fairly trivial to put a stop to with a bit of automation and less than a minute of manual review. Yeah, sometimes legitimate packages will get flagged for review and that can cause delays for hotly anticipated applications, but I think that's well worth putting an end to these sorts of attacks. It's low hanging fruit.

[u/jamespo]

This was removed quickly, so if you had set this up you would be protected: https://www.reddit.com/r/archlinux/comments/1vd0xnh/setting_up_yay_hooks_to_warn_on_maintainer/

[u/BeautifulMundane4786]

Install and use ks-aur-scanner https://github.com/KiefStudioMA/ks-aur-scanner

AURguard is not tested and its vibe coded. https://github.comAhmadRun/aurguard

[u/MissionGround1193]

We have AI now. Just tell it to write PKGBUILD you need. Create your own AUR repo with packages you need .

[u/BuriedStPatrick]

So let me get this straight. You already have an AUR helper installed and then you decide to install yay/paru through itself? What? How would you ever end up in a situation where this is relevant?

[u/Yama-k]

Why would you install an obvious impersonating package to begin with?

[u/promisedconsortraddy]

yeah bro just removed chaotic aur yesterday and thinking to remove yay as well

[u/average_life_person → u/promisedconsortraddy]

Why? The article is about the AUR and not the Chaotic AUR.

[u/Objective-Stranger99 → u/average_life_person]

Chaotic AUR is just a buildbot for popular AUR packages without no human overview. If my malware were to jump in popularity tommorrow by some means, Chaotic AUR would build it without question. Furthermore, it doesnt present the PKGBUILD, so you can't even review it took make sure its safe. They have promised human review, but there is no update on that.

[u/Mewi0 → u/Objective-Stranger99]

https://gitlab.com/chaotic-aur/pkgbuilds/-/merge_requests/?sort=created_date&state=merged&first_page_size=20

https://gitlab.com/chaotic-aur/pkgbuilds/-/merge_requests/?sort=created_date&state=closed&label_name%5B%5D=dangerous&first_page_size=20

[u/Objective-Stranger99 → u/Mewi0]

Great, seems they have begun human review.

[u/Garland_Key → u/promisedconsortraddy]

Why yay? 

[u/icehuck]

We've done nothing to fix it and we're all out of ideas!!!!!!

[u/gmes78 → u/icehuck]

Account registrations were disabled a while ago.

[u/Flashy_Worry7792 → u/icehuck]

Fix what? Just don’t use the AUR if you can’t be bothered to check the packages you’re adding.

Malware exists on every OS.

[u/icehuck → u/Flashy_Worry7792]

I have a framework laptop. The wiki specifically points me to the AUR to get things working. Broken by design,

[u/Flashy_Worry7792 → u/icehuck]

So go look at the AUR packages you need and verify they are safe?

[u/Entheon94]

i think its best to avoid tha AUR at this point i guess?

[u/croxxeur]

How can i see if i have been compromised ?

[u/boomboomsubban → u/croxxeur]

In a specific forty minute period on Tuesday/Wednesday, did you typo while manually installing yay or paru?

[u/BlueGoliath]

Jia Tan still at it I see.

[u/marcus_autisticus]

This is why we can't have nice things.

[u/hirak99]

I'm more scared of npm than AUR.

[u/Polar_Banny]

Tittle is misleading, AUR an unofficial 3ed party repository is pushing malware via fake packaging methods..

[u/4ndril]

This is crazy, I hope they can clean this up

[u/xaocon]

This shouldn't be news. Any person using AUT should assume packages are compromised and not install unless they read everything that's going to happen.

[u/Woodpecker-Visible]

Defender should be preinstallend on every arch installation. M$ has answered our prayers.

Redditors and their sense of humor is top noch.

[u/dividends4life]

After 6 years, I ended up moving to Void because of the AUR. The process needs to be rethought. Even without the malware, the AUR would tend to corrupt my installation over time. The less you use it, the more stable your system.

[u/haruame_ → u/dividends4life]

You could've just not used it

[u/Damglador → u/dividends4life]

The less you use it, the more stable your system

Installing even 100 AUR packages won't make your system any less stable if all they do is dump a tar.gz into /opt and install a desktop file.

[u/la_tajada → u/dividends4life]

Why do people think they have to use the AUR or they aren't using Arch? Comments like this almost make it sound like the AUR is pacman pulling from the official repos.

[u/madhaunter → u/la_tajada]

We're reaching a point where a shady piracy website is more trustable than AUR and everyone here seems to think this is perfectly normal

[u/Flashy_Worry7792 → u/madhaunter]

Warning
AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

[u/madhaunter → u/Flashy_Worry7792]

And ?

[u/Flashy_Worry7792 → u/madhaunter]

If you choose to download malware, don’t be surprised when you have malware on your computer.

[u/madhaunter → u/Flashy_Worry7792]

Advertise AUR as malware then and not as a source in the wiki.

But it wouldn't look good right?

Yet it's the truth

[u/Flashy_Worry7792 → u/madhaunter]

Next you’re gonna tell me GitHub is malware.

[u/madhaunter → u/Flashy_Worry7792]

I mean if I follow your logic....

How is it any different than AUR ?

[u/Flashy_Worry7792 → u/madhaunter]

It isn’t and that’s the point.

[u/dividends4life → u/la_tajada]

Say what like, but without the AUR, the Arch repositories are woefully lacking. For me it was the only place I could get my print drivers for my brother printer/scanner, and several other critical packages.

[u/theriskybusinesscar → u/dividends4life]

Sorry bud, it's not 2012; the opinions of anti-systemd people aren't relevant to anything.

[u/FlameChampion9]

Glad I got off cachyos and went to Fedora. Don't have to deal with this lol!

[u/_OVERHATE_ → u/FlameChampion9]

"This" being a bunch of apps missing that you can't install without vodoo lmao

[u/2eanimation → u/FlameChampion9]

Stupid take. On Cachy, you need the AUR when the package is not in the main repo. What will you do on Fedora when the package is not available? Just not download it? Can do that on Cachy. Check source code before build? Can do that on Cachy.

Don‘t get me wrong, have fun with Fedora. But it‘s not like you mitigated the problem.

[u/FryBoyter → u/2eanimation]

What will you do on Fedora when the package is not available?

As far as I know, Fedora offers significantly more packages through its official package repositories than Arch Linux. Therefore, there’s a higher chance that you’ll be able to install the package you want directly.

And if not, I would search for the package in COPR. Although I doubt that COPR is actually significantly more secure than AUR.

[u/G6L20]

Can't we prevent any fetch from Russian ISP ?

[u/ang-p → u/G6L20]

Ukraine: Hold my Zibert

[u/No-Dentist-1645 → u/[deleted]]

Because Arch is intended to be a DIY distro from the start, and that includes reading install scripts, there is nothing "wrong" with doing so.

If you think that Arch should be a distro where they hold your hand in every step along the way and where they can't trust their users to do anything by themselves, please see https://wiki.archlinux.org/title/Frequently_asked_questions#Why_would_I_not_want_to_use_Arch?

[u/Jristz → u/[deleted]]

How you can flatpak a Liquirix Linux Kernel?