240
God, even the Arch malware uses npm as a vector. And thus, my hatred of npm deepens even further
Tbf, it is run in package post install section so it could be anything even the typical "curl malware.om | bash". There is a new wave of attacks now pulling things in with Bun which i guess is similar thing to NPM
I'm just a web guy whose tired of installing 10 xetabytes of 2 line libraries every time I wanna check out anything web related
Ah yes, review the PKGBUILD for every AUR update. Luckily I do this while I'm rereading the ToS every time those get changed for all my software as well.
When I finish that I intend to read the changelog in git for each of the commits since the last update.
I always check with my contract lawyer before installing or updating from the AUR. It's worth it for me.
What can be done to prevent this from happening to the AUR?
The AUR is kind of a trap. It can be useful but it has the warnings it has for a reason. Maintainers are not vetted so you depend on them both to be benevolent and competent and neither are reliable.
No one should really use it without taking the time to understand pkgbuild but you have people recommending AUR helpers like yay and tying AUR updates to regular system updates which is a terrible idea
paru always shows you the diff of the PKGBUILD on upgrade, so no need to worry about adding it to an alias that does both.
In fact, just running paru is the same as running
pacman -Syu
paru -Sau
At the end I review the PKGBUILDs and make sure everything looks reasonable. Usually it's just new source hashes, but not every time.
What do you mean by "tying AUR updates to system updates" ?
As in updating the AUR when you update your system packages, which come from known sources.
And just to be very explicit why this is an issue: each time the package is upgraded through an automated update, the PKGBUILD may change (e.g. to adapt to different dependencies, file structure, etc introduced with new app version).
That also means an AUR maintainer can smuggle in malware with any of those updates, even if you checked the original PKGBUiLD when you installed. And, anyone can request taking over maintenance for unmaintained packages, so it can even happen if the original maintainer was benevolent.
Always check PKGBUILD files on upgrade, even if just a glance. If I remember correctly yay had a function to always show you PKGBUILD diffs before updates, not sure if that was automatically enabled.
Paru shows you the diffs by default.
I just run paru when I do system upgrades. Very convenient to have one command doing everything in a somewhat safe way.
Of course, inspecting the PKGBUILDs still doesn't protect us from having the actual software repositories compromised. Just because only the source hash changed doesn't mean the software doesn't have malware now.
That's where I draw the line regarding trust. I don't feel like going into to each release of each AUR package I have installed to check code to see if malware was injected. 😅
Paru shows them by default, and it’s basically impossible to disable.
It is a little too easy to skip past it, though.
Yeah, it's never sat very well with me. I've gone through cycles where I'll use a good bit of AUR, to none at all. I had been using a handful of things, but realized that almost all of it was Python stuff that I could more safely install with pip or uv, so I've migrated all of that. The one thing left is Manuskript, and it hardly gets updates anyway.
The way to prevent it is to get more stuff into the official repos so people aren’t forced to rely on AUR in the first place.
load more comments
(2 replies)
in theory? getting rid of paru and friends, manually reviewing the pkgbuild and the source of whatever it is installing
realistically? nothing. the AUR is a glorified repository of build scripts anyone can upload. the script or the package itself can ship malware
the AUR is mostly the same as downloading and running random exes on windows. you should avoid it, make it as manual as possible (forcing you to double check what's happening) and be able to review the installer/package or trust someone who can vouch for its safety
paru shows you the PKGBUILD diffs on upgrade, so you can review then and deny upgrades.
But realistically I am not going to go into the code itself on my installed packages to check for malware or other types of attacks. That's too time consuming for my risk level, and requires more knowledge than can be expected, to be honest.
Edit: but maybe you're talking about when first installing a package? Come to think of it, I'm not sure it shows the PKGBUILD at that point. 🤔
It does, the diff shows the full files.
load more comments
(1 replies)
load more comments
(2 replies)
The AUR is unsafe by design. It's not intended to be something you just install from willy-nilly. It's intended to be a helpful way for arch users who know what they're doing to exchange a convenient way to install arbitrary packages. But you should always be just as wary of it as copy/pasting shell code from a random person on the internet.
load more comments
(1 replies)
Trying to escape surveillance capitalism while installing aur packages willy-nilly.
Are you one of the malicious actors? Thats some shit I'd expect to hear from the people doing this, trying to justify the attack by blaming the users for "capitalism".
I am quite confused by your assumptions. I am just making a joke about people trying to avoid surveillance capitalism tools on one side and gleefully installing aur packages from random people on the other side, potentially making their surveillance exposure worse. I'm part of them some time because it's too hard to verify everything everytime.
load more comments
(1 replies)
i can empathize with those infected but it's important to note that the source of this issue is still installing random stuff from random people. the aur is not the same as arch repos, and users wanting to opt in need to take more precautions than usual
load more comments
(1 replies)
~~Users can check if they're already compromised with pacman -Q | grep alvr I think maybe?~~ EDIT: No, sorry, alvr was just one of countless affected packages. Also, several is an understatement since a huge number of packages are affected.
Post with more information here: https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/
alvr as in the vr streaming program for standalone headsets? that's kind of a niche among niches. Linux VR users with standalone vr headsets that use that specific method.
Sweats in “linux vr is one of my current hobby projects”
it's going to be year of the linux vr soon anyway
I am so hyped for this actually
I panicked a bit when I saw the news earlier today as one of those niche guys. Then remembered I had removed it for WiVRn a few weeks ago and don't have anything else off the AUR. Double niche win lol
EDIT: No, sorry, alvr was just one package, there is no specific source for the infection just one or many malicious users: https://gr.ht/aur_pkg_list.txt
load more comments
(1 replies)
Oh my, I'm new to Linux and I use CachyOS for my gaming rig at home. Most of the time I have no idea what I'm doing, but shit runs well and I'm happy about it. But how the hell do I check my noob ass if it's compromised?!
load more comments
(1 replies)
Hilarious that it's JavaScript again, truely npm, pypi and cargo are obvious targets. Also, guys, minimise your usage of the AUR! I don't use any AUR packages.
Core > Extra > flathub >>>>>>>>>>>>> AUR
Not that core/extra/flathub can't be pwned but it's harder then the AUR.
I'm interested why flathub > AUR? I try to minimize AUR usage but always assumed it's better than flathub?
Not the one you asked, but it's a case of priorities:
- If you want it to just work, then the AUR is probably the better pick. Don't get me wrong, through; most flatpaks should (mostly) work like how you'd expect them to behave natively.
- But, (Op)Sec-wise, the verified flatpaks win. No contest. Simply, because there's no third party involved in the process. (And I haven't even gone over flatpaks' superior sandboxing.)
load more comments
(2 replies)
Here’s a incomplete list:
https://gr.ht/aur_pkg_list.txt
I know some on Lemmy here use the RuneScape launcher.
For an automated script to help you check, you can use https://github.com/lenucksi/aur-malware-check to see if you're infected.
Very useful, thanks.
Came up clear, fortunately.
Out of curiosity, did Arch send any notifications through pacman or anything? The first I heard of this was on Lemmy.
I haven't seen anything through pacman though
load more comments
(1 replies)
I miss the browser, but luckily I haven't played RS since the new CEO cancelled new Pride Events right after the Trump Admin was reelected.
This reminds me to remove the Fluxer AUR package I have
yikes, I'm glad I decided to switch to debian stable recently, not that it's a foolproof system either
Yeah, it seems like these sort of problems aren't necesarily due to an insecure system like the AUR but moreso because of the target's publicity and popularity which is definitely the case with the rise of CachyOS.
Why is the atomic-lockfile thing not removed from npm?
view more: next ›
this post was submitted on 12 Jun 2026
240 points (99.6% liked)
Linux
14365 readers
247 users here now
A community for everything relating to the GNU/Linux operating system (except the memes!)
Also, check out:
Original icon base courtesy of lewing@isc.tamu.edu and The GIMP
founded 3 years ago
MODERATORS