Arch Linux’s AUR is experiencing a malware incident involving user-contributed packages with malicious commits that attempt to download npm-based payloads during installation. (…)
Arch users should not update AUR packages without review. Examine PKGBUILD diffs, check any new .install files, and be cautious if updates introduce npm commands or dependencies unrelated to the software.
Users who recently updated affected AUR packages should review package history, examine executed suspicious install scripts, and treat any unexpected npm-based installation behavior as a possible compromise.
To potentially prevent this entire class of npm attacks in the future, you could edit
/etc/pacman.conf, uncomment# Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup #IgnorePkg =And set it to
IgnorePkg = npmYour system should prompt you to accept installing npm because it’s in the ignore list. These packages set it as a dependency, so that gives you a chance to notice that something’s off and refuse the install. This assumes you don’t already have npm installed or need it for some reason.
edit: word is that
buncommand is being abused as well and may be worthwhile including in the space separated list:IgnorePkg = npm bundeleted by creator
Because the NPM is a complete mess and it’s super easy to exploit for supply-chain attacks by sneaking malware into one of the billion dependencies required by most popular packages.
deleted by creator
AUR “packages” are just a recipe file that runs some commands that sources packages from somewhere else and builds them then puts them in the format required by the AUR package manager.
Normally it’s a source tarball downloaded directly from the project’s Git repo. But it can also fetch and install a binary package (for closed source software). Or it can install Node modules, or Python modules etc.
Point is, you can’t inject a script directly in AUR itself. You could add the malicious code directly to the recipe file but it would be obvious. You could also download a zip with the malware directly, but it would also be obvious.
So what they do is add the malware to modules published on another platform, and they’re downloaded indirectly, as a dependency of the Nth grade.
It’s very hard to detect, you can’t really notice this kind of attack with a glance at the recipe.
deleted by creator
But why would they care about supply chain attacks if they already have hacked into the package you’re requesting? In that case, executing python scripts would be less noticeable
Here’s the AUR recipe (PKGBUILD file) for a random package:
https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=nautilus-git
This is a standard format for the recipe. It’s Bash code used to define variables and functions.
You’ll notice there’s no place to sneak in a Python script. There is some brief Bash code in the functions but any major stuff would stand out immediately. So would an command that fetches a malware zip from a weird URL.
Meanwhile, if you add
nodeorpythonto the dependencies, and then run a command that installs a perfectly legit npm or pip module, nobody would bat an eye. It’s impossible to figure out that among the many upstream dependencies of that module there might be one that was subverted to discreetly run malware.AUR is a very bad idea tbh and should not be used by the faint of heart. It makes it entirely too easy to pull this kind of crap.
AUR is a great idea, misusing it is a bad idea.
AUR itself is fine, the issue in this case is more with the automated system allowing anyone to take over orphaned/abandoned packages. This is a targeted attack leveraging that system.
this is like the 4th npm vulnerability in months, they used that because npm is shit and easy to exploit
deleted by creator
What a terrible article.
“Multiple” packages mentioned in the title, but they’re unable to actually name more than one in the article…
//edit
Actually, they did leave a link to the mailing list thread at the very end.
I should learn to read the entire article…I was wondering why you felt that way 😅 Usually this source produces good content lol
Me, a Debian user watching that shitshow 😎
Me, an Arch user (btw), watching the NPM chaos on any distro…
That’s another reason I like cachyos: they have a curated list of aur pkgs in their repo.
To be fair, basic checks should be done not just make account and in next 10 seconds accept abandoned package and publish malware.
I wasn’t hit according to the public script but I am definitely rethinking my use of Arch and most certainly refraining from the AUR as much as possible going forward. This is far too many events in such a small period of time for me.
… how do i make npm generally not work on Linux? I don’t use it and with how attack vectors are the majority of cases via NPM… and can be shipped as a binary to <arbitrary temp location>.
Environment variables pointing to /dev/null? Application firewall? Or would just blocking some domain/IP suffice?sudo {package-manager} remove npm nodejs sudo {package-manager} purge npm nodejs
npm: sudo tee /usr/local/bin/npm >/dev/null <<‘EOF’ #!/bin/sh echo “npm is blocked on this system.” exit 1 EOF
sudo chmod 755 /usr/local/bin/npm
npx: sudo tee /usr/local/bin/npx >/dev/null <<‘EOF’ #!/bin/sh echo “npx is blocked on this system.” exit 1 EOF
sudo chmod 755 /usr/local/bin/npx
Might break somethings but that’s a part of boycotting something I guess.
Thanks, but
and can be shipped as a binary to <arbitrary temp location>
You can’t just ship a binary to a random location without knowing architecture, which is very relevant. Not everything is x86 any more. But you can do shell, and since aur is shell that should be good enough given the context of the article.
