A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems.
  • yesman@lemmy.worldEnglish
    77·
    1 day ago

    The article has instructions to do exactly that.

    Users who regularly install AUR packages should take the following steps immediately:

    Run pacman -Qm to list all foreign (AUR) packages installed on your system and cross-reference against the published list of compromised packages

    Audit recent PKGBUILD history for any packages installed between June 10–12, 2026

    Rotate all credentials — browser passwords, SSH keys, API tokens, and cloud access keys — if any flagged package was installed

    Scan for suspicious processes masquerading as kernel threads using tools like rkhunter or chkrootkit

    Consider using AUR helpers with PKGBUILD review prompts enabled by default.

    The Checklist of infected packages

    • Tetsuo@jlai.luEnglish
      26·
      4 hours ago

      Ok, but I was expecting something a bit more automated then opening a list of package in kate and comparing it to my list of installed AUR package… Plus it’s 400 package so that’s a lot of things to check and plenty of space to miss one package by manually checking.

      But I get it I’m lazy and just need to script something myself. This is affecting so many people I thought we would have a script to check quickly if you are “infected”.

      Edit : thanks for the numerous script sent as reply ! But I’m all set now, thanks !

      • wonderingwanderer@sopuli.xyzEnglish
        3·
        14 hours ago

        It’s at the bottom of the doc:

        echo "Checking for infected AUR packages (${#INFECTED_PKGS[@]} total)..."
echo

found=()
for pkg in "${INFECTED_PKGS[@]}"; do
    if pacman -Qi "$pkg" &>/dev/null; then
        found+=("$pkg")
    fi
done

if [[ ${#found[@]} -eq 0 ]]; then
    echo "Clean: none of the known infected packages are installed."
else
    echo "WARNING: ${#found[@]} infected package(s) found:"
    for pkg in "${found[@]}"; do
        echo "  - $pkg"
    done
fi

        Not sure why it uses -Qi instead of -Qm since there’s no point in scanning pacman packages, but I’m no expert

      • Holytimes@sh.itjust.worksEnglish
        71·
        1 day ago

        how many aur packages do you have? Most people i know have like AT MOST 20 or so packages from the aur. Which takes less then 2 mins to manually check against the list.

        • BurgerBaron@quokk.auEnglish
          1·
          5 hours ago

          I try to not use any, I have 6 and 4 of those are maintained by the developer, not some rando.

          One I really dislike is that CachyOS when you install their gaming software bundle…it uses the AUR version of Heroic Games Launcher instead of their own repo and CachyOS does not maintain the Heroic AUR AFAIK. I guess because AUR updates more frequently than their own repo? I think it’s bad practice.

        • Kjell@lemmy.worldEnglish
          1·
          7 hours ago

          I have much more than 20 packages in aur, most of them are dependencies from steam-native-runtime. Since steam is popular, I can understand that many have more than 20 packages.

          Now when I was reading the ArchWiki I saw that it is mentioned as an alternative, so I assume I can remove steam-native-runtime and all dependencies. Perhaps the instructions have been updated or I googled for instructions and found another page. But there could be other popular packages with many dependencies.

        • Tetsuo@jlai.luEnglish
          1·
          1 day ago

          I’m not home for a few days so I can’t check yet.

          But I think I have something like 3/4 packages at the most.

          But I need to compare that to a 400+ list I’m not sure I agree with you it’s that easy to do rigorously.

          • shelf@piefed.socialEnglish
            1·
            3 hours ago

            you only need to check your 3 or 4 packages to see if they were installed/updated during a certain date range.

            • Tetsuo@jlai.luEnglish
              1·
              3 hours ago

              Considering I haven’t been home since the 6th of June, I assume I probably couldn’t have been infected. But I will still do a thorough check when I get home next week.

          • hoppolito@mander.xyzEnglish
            5·
            1 day ago

            Not sure I understand - if you only have 3-4 packages you can just search for them specifically in the long list?

            Even if you have 50 or 100s of packages, bash makes it pretty doable

            comm -12 <(sort -u file1.txt) <(sort -u file2.txt) > common.txt

            Should spit out only the packages appearing in both lists (done by memory so may not be 100%)

      • NebulaNymph@programming.devEnglish
        3·
        1 day ago

        I haven’t used kate but does it not have some sort of easy search?

        ex. pacman -Qm to list AUR packages; should display the 3/4 pkgs you have installed. Then just search in kate for those 3/4 results?

        Alternatively cat & grep in the terminal is pretty straight forward.

        That is if it’s 3/4 pkgs that are from AUR, but if someone has hundreds installed that is a bigger issue on its own.

        • Tetsuo@jlai.luEnglish
          23·
          1 day ago

          Am I missing something ?

          Just because I have 3/4 package on my system doesn’t mean the 400+ list of affected package gets shorter on the other side…

          I’m actually pretty cautious with AUR and I only install them when there is no other options.

          • m4ylame0wecm@lemmy.zipEnglish
            8·
            1 day ago

            Especially for a small list, 3-4, that you actually need to check, what’s the actual issue? Open list of 400, ctrl+f for the few names you care about, move on.

          • shweddy@lemmy.worldEnglish
            5·
            1 day ago

            I was just curious because I didnt think it was so tediuous to check against an alphabetical list on a website using ctrl+f. But thats just me. It took me less than a minute to check my 8 aur packages against the list

      • flying_sheep@lemmy.mlEnglish
        1·
        5 hours ago

        Arch usually doesn’t re-package Python packages that aren’t needed for something else, meaning they end up in the AUR. I maintain several there, and when I stop using them I abandon them. I wouldn’t be surprised if some of the ones I used to maintain are on the list

      • Eldritch@piefed.worldEnglish
        6·
        1 day ago

        Yeah, Python has been a massive vulnerability for a long while. And the AUR has similar issues. This is only getting widespread coverage now. But it’s always been a risk.

        • HaraldvonBlauzahn@feddit.orgEnglish
          1·
          7 hours ago

          Yes, we need a kind of Debian for Python.

          Part of the solution could be the Guix package manager. Part could be the commercial offerings, like Anaconda.

      • CaptDust@sh.itjust.worksEnglish
        41·
        1 day ago

        Well, those are mostly extension libraries, stuff “normally” installed using pip. Arch is kind of unique that they encourage using system aur over pip, npm and other package managers. While it is a big radius, none of the python packages stick out to me, but maybe I just haven’t encountered the popular ones.

        • iocase@lemmy.zipEnglish
          5·
          1 day ago

          The attackers specifically targeted orphaned projects on AUR so it’s no wonder most of those aren’t familiar to us.

        • esc@piefed.socialEnglish
          3·
          23 hours ago

          It isn’t really all that unique? Debian does it, el does it, probably almost any popular distro?