FRESH

Hacker News

Home

AUR packages compromised with Infostealer and Rootkit

232 points by keyle

by Tharre

8 subcomments

People need to get into their heads that the AUR is just a collection of user-produced PKGBUILDs.
You have to review the source of every PKGBUILD from the AUR you install, full stop. Yes that includes any updates. This really has always been the case; we've had discussion about this for well over a decade. People are always asking why there's no official AUR helper like yay - this is why.
A lot of people complain about Arch Linux being elitist, but the simple reality is it's a distro built for people who know what they are doing and don't need or want their hand held at every step of the way. This also means that if you break or compromise your own system by installing random AUR packages, it's your own damn fault.
All of that being said, the era of allowing anyone to adopt AUR packages might be coming to an end. If for no other reason then the effort of rolling back every affected package every time is too high. I'm not sure what the alternative would be, reviewing every adoption request seems like too much effort and wouldn't necessarily even help every time.

by harvie

5 subcomments

7+ hours into this and still no mention on archlinux.org webpage nor on aur.archlinux.org. Why??? AUR should have been blocked until user takes action to prove he knows about this.
Eg. change AUR API URL slightly so yay/yaourt users need to look up what is going on. New API should have infrastructure for informing users and making sure they've read the message before proceeding. Especially when they're not even sure that all malware was found.
Also there should be database of revoked/compromised AUR commits and there should be mechanism to warn user if they had it installed.

by xx_ns

2 subcomments

This campaign is still ongoing. I just got an email that one of my old packages (which hasn't worked for years and was orphaned for a while) was adopted and immediately a malicious commit was pushed. They seem to be using bun instead of npm now, so any npm-based workaround likely isn't effective.
https://aur.archlinux.org/cgit/aur.git/commit/?h=toggldeskto...

by spystath

1 subcomments

Obviously installing anything from AUR must be done cautiously and there have always been sketchy (as in improperly built/packaged) packages in the past but seeing actively malicious injections is concerning. I think there are two main problems with AUR: 1. it is a remnant of a slightly more egalitarian era in the open source history when you could generally trust 3rd party code and 2. orphaned packages can be adopted by anyone with their full history and vetting intact.
I think we are well past (1) but (2) could be mitigated by tighter controls on AUR accounts and potentially additional safeguards from AUR helpers. Maybe show a big scary warning if the package has changed owners recently. I know there will still be people that will "y" their way forward but it's better than nothing.
Or just avoid AUR helpers altogether and inspect/build the packages you need yourself from their PKGBUILDs directly.

by aquova

0 subcomment

As people have noted, this sort of thing has become inevitable and likely to increase in occurrence unless some changes are made. I'm a big fan of the AUR PKGBUILD system, and I leverage it quite frequently to write my own. The most egregious issue in my opinion, and one of the low hanging fruit to fix, is the fact that anyone can adopt an orphaned package with no notification to end users that this has happened.
It's honestly more trouble than it's worth to get your package deleted, instead leaving orphaning as the more optimal way to relinquish control. This should be the opposite in my opinion, or at the very least the users should be made very aware that an orphaning has occurred. Perhaps that burden is more on the AUR helper like paru and yay (who I would encourage to make such a change).

by UI_at_80x24

4 subcomments

Here's an easy script to scan for compromised packages:
https://cscs.pastes.sh/aurvulntest20260611.sh
Not my script. It's easy to read/parse. Never pipe a script directly to bash.

by williebeek

3 subcomments

I remember installing an emulator (Mednafen) on Arch Linux about a decade ago. The program failed to run because it was linked against a library my system didn't have. Turns out, the maintainer built the software on his own system and it used a library he had on his system but was not listed in the dependencies.
It is an officially maintained package and I always assumed these were built on a dedicated build server instead of some a random volunteer/home computer. Don't know if Arch still builds the same way but this event scared me enough to switch distros.

by keysersoze33

2 subcomments

The (Arch) community is moving quickly to release scripts/tools.
Right now, this is the most up to date, consolidated utility to check for infection:
https://github.com/lenucksi/aur-malware-check
Also, the aur-request mailing lists has many delete/orhan requests coming through to undo the malicous commits:
https://lists.archlinux.org/archives/list/aur-requests@lists...

by bachmeier

2 subcomments

So what's a solution to this? Install packages like this in Docker containers without network access? I don't think we should assume it's limited to AUR. Every software source should be considered suspect in 2026, particularly with the adoption of vibe coding, and closed software is a bigger mess than open source because it's a black box.

by sandreas

1 subcomments

So, could anyone sum up the "Am I owned" part of the problem to check which measures to take?
AFAIK I'm pretty likely owned if all of this is true:
- The following line shows at least one affected package:
```
  echo "Affected Packages Found:"; comm -12 <(pacman -Qqm | sort) <(curl -s https://cscs.pastes.sh/raw/aurvulnlist20260611.txt | sort) | { read -r l && printf '%s\n' "$l" || echo "None. No known compromised packages are installed."; }
```
- I updated AUR in the last 24 hours
If I did not update AUR, in the last 2 days, it should be ok (at least for this specific problem).
If I don't see affected packages from the line above, it is probably ok, but maybe there are malicious packages that are not listed and yet I'm still be owned, so I have to be careful.
Is that correct and if not, what did I get wrong? And are there any checks that I can perform, that proof the status of the system?

by DavideNL

0 subcomment

Would using traur have prevented this attack?
https://github.com/Sohimaster/traur

by nialv7

0 subcomment

third time this has happened:
https://news.ycombinator.com/item?id=17501379 https://news.ycombinator.com/item?id=44607740

by WhyNotHugo

2 subcomments

This is one of the aspects of AUR which never fully convinced me: it purely hosts user-generated content, there's no review process or alike.
I'd really prefer to see a model where a 'community' repository contains user submitted packages which have at least one Trusted User review the package before it's merged in. This doesn't just prevent malware, but also common mistakes in general.

by keyle

0 subcomment

More news is coming out about this:
https://www.phoronix.com/news/Arch-Linux-AUR-400-Compromised
I toyed with the idea that someone should write a binary that simply emails, or alert you when it's been run... as a canary... and call that `npm`.
At this point, not renaming the npm binary is a big risk.

by cf100clunk

0 subcomment

Lots of discussions now, from different source articles:
https://hn.algolia.com/?dateRange=last24h&page=0&prefix=fals...

by Retr0id

1 subcomments

I haven't used Arch for a few years now, but when I did the AUR was my favourite aspect.
It was never perfect from a security PoV, but in 2026 this kind of trust model feels increasingly scary.

by secret-noun

0 subcomment

Here's a commit showing how they did it: https://aur.archlinux.org/cgit/aur.git/commit/?h=pass-cli&id...
Internet archive URL: https://web.archive.org/web/20260611213640/https://aur.archl...

by hootz

0 subcomment

There are some AUR hooks that can help. I use https://github.com/Sohimaster/traur which also has scans for orphan package takeover patterns.

by lordleft

2 subcomments

This is especially gnarly as more people have been picking up arch distros as of late (like CachyOS).

by yaakushi

0 subcomment

Not the first time this has happened recently. There were a few emails in the AUR list a few weeks ago about malicious packages, and a few reports on IRC too. The only difference in the campaign back then was the malicious npm package name (`linux-utils` in the campaign a few weeks ago).

by cherrycreek00

0 subcomment

Am I understanding right that machines without npm aren't affected by this particular strain?
The headline got my heart going pretty good this morning.

by Artoooooor

0 subcomment

Thanks for the link. It contains link to list of the affected packages, that will be useful.

by dtag00

1 subcomments

Is there a way to verify if the malware is actually installed on a machine?

by self_awareness

2 subcomments

How a person 'adopts' 408 packages and controls their build scripts?

0 subcomment

by sph

2 subcomments

Be aware of false positives! I found I had two of these packages installed, clang19 and compiler-rt19, but due to my recent laziness in updating my system, mine were still the versions from July 2025 from the official repos before they had relegated them to AUR.
You can check the build and install date with `pacman -Qi <package>`.
I run Arch Linux in a container (within Fedora Silverblue), but my plan for the future:
- consider switching away from Arch Linux for my dev container, with great sadness. A rolling distro is a terrible idea in the current security climate. I loved using Arch for my dev container exactly because of AUR.
- switch to Fedora Stable, perhaps the previous release which still gets security fixes but no other updates. I am still on Fedora 43, I guess I have no rush to update to 44. - be even lazier in updating my workstation. I used to update daily when I was running Arch, then I moved to weekly last year when I got stuck with slow internet, now consider updating monthly or more (of course, unless there are critical security bugs)
- Flatpak and Flathub terrify me, it's only a matter of time until malware appears. I have had automatic upgrades disabled for a while.
- for the love of God don't touch anything that uses npm
Previously: https://news.ycombinator.com/item?id=48458931

by OtomotO

0 subcomment

If you're unsure what you've installed from the AUR, use: pacman -Qm

by Noaidi

0 subcomment

Thanks AI!

by animitronix

3 subcomments

Wow, this is effectively the end of the AUR model. There's been a malicious package or two before, but an attack this widespread shows things are fundamentally broken. Guess I'll be switching to a new OS this weekend across multiple machines.

by QuantumNoodle

2 subcomments

Man, I never hear good security things about npm

0 subcomment

by lenucksi

0 subcomment

[dead]

by lenucksi

0 subcomment

[flagged]

by virajk_31

2 subcomments

AUR doesn't guarantee security, its upto the user to use AUR & verify before installing anything, its very evident why arch is not used in enterprise solutions.