As an user of the AUR, this is devastating news to me. I am also guilty of accepting updates without reading the latest changes, even if
yayasks me if I want to. This is a reminder to everyone to only install from the AUR for absolutely necessary stuff only, and only if you trust the maintainer. And to at least have a look if something suspicious is going in with the recent changes in the package recipe. AND to read in the communities and news.I don’t understand why there still no official announcement as a warning from the Archlinux team at https://archlinux.org/news/ . Is there a different place for security news specifically about the AUR to subscribe to? EDIT: https://archlinux.org/news/active-aur-malicious-packages-incident/ They did it, an official message.
The fact that the Arch maintainers seem to prefer Reddit over their own fucking news channel is what made me switch from Arch years ago. I got sick of upstream breaking changes fucking my system because they wouldn’t notify people through official channels, only to find it later on /r/archlinux 🙄🙄🙄
since the 2022 grub incident, Arch has done a great job at notifying the news channel when “manual intervention required” AFAIK, and I don’t remember any instances of Arch maintainers only notifying Reddit (and I don’t think they notified Reddit for the grub incident either lol).
It’s been 4 years already? WTF?
What are you using now?
After the end of Win10 I moved to arch but I think my week end will be filled with moving again. ^^
On my desktop, CachyOS 💀
It was years ago when Arch pissed me off, but I couldn’t resist Arch-based distros forever. So far, I haven’t been burned.
On my laptop, Asahi Linux, which is basically Fedora ARM with a custom kernel. I’d recommend Fedora to most general users.
deleted by creator
They made an announcement though
the arch news channel is for breaking changes to arch pacakges (so not the AUR) only. maybe you could subscribe to aur-general@lists.archlinux.org.
They are actually putting a message on the regular news feed about the AUR! https://archlinux.org/news/active-aur-malicious-packages-incident/ As it should be. It just took a bit too long in my opinion, as discussions are going on since yesterday.
I was hoping to subscribe with RSS. Not sure how to subscribe there.
it’s a mailing list, so heads up, if you subscribe you’re also gonna get other discussion like the forums.
https://lists.archlinux.org/mailman3/lists/aur-general.lists.archlinux.org/
This is a reminder to everyone to only install from the AUR for absolutely necessary stuff only, and only if you trust the maintainer.
Unfortunately not foolproof either. I have no infected packages that I know of because I happen to be on a new install, but I caught wind of the LAST AUR botnet infiltration and switched to flatpaks or source builds. Since then I drifted back to AUR for convenience. I thought I was being clever only using AUR packages when I could be “sure” the author of the original software package pushed to AUR, and this was easy since devs who build on Arch typically recommend AUR whether they maintain the package or not. Today I found out spoofing package ownership is apparently easy and so is spoofing git credentials.
I was on Endeavour and it was incredible, but I’m not That Power User and I feel like part of the problem. The worst part of all of this is its owing to an influx of users who want the same ease of use they used to enjoy, but in Windows SOP is installing whatever the fuck you want on Internet Explorer and bugging your sysadmin to fix whatever happens. Its probably really hard to be any kind of FOSS developer right now.
Yes, definitely not foolproof. This is more of a wake up call to be at least careful and reconsider every single AUR package one has installed. For me, I was lucky too. But in my case it wasn’t pure luck that the few AUR packages I have installed aren’t affected. See, because since years using the AUR (sparingly! including my own package :D ) I always feared off orphaned packages and removed them as soon as I could. This incident here is proof I was right.
For some stuff I also prefer the Flatpak, because I do not trust everyone on the AUR, as they operate on root rights! When I brought this up on Endeavor, they disliked my opinion (as a fresh user) and the trusted community members there explained to me that the AUR is way more safe than Flatpak, because there is a trust system of upvotes and everyone can flag the packages, and that Flatpak has a wrong sense of security. That is what they told me and totally ignored my issues with AUR… one of the reasons why I do not visit the EndeavourOS community… I digress…
The AUR is basically just a shortcut for downloading random shit off GitHub.
It gives un-experienced users a false sense of security.
The false sense of security is actually caused by people saying the AUR is the easiest way to safely get all your packages, when in reality the AUR itself tells you to always review PKGBUILDs and to not blindly trust AUR packages.
AUR
There were announcements and security ping in the arch Linux community discord… But I wish they’d be more vocal on this outside discord especially given discords controversy as of late
Update: they finally posted about it in the arch news feed last night… A bit late but better than never. Npm removed the malicious package, but then the bad actors started using bun instead…
As others have proposed, I really think that orphaned packages should require a moderator of the aur to approve the commit and acquisition of an orphaned package. Currently nothing stops someone from spinning up accounts and hijacking these abandoned projects
Thee’s a official Arch Linux D*scord?
No it’s unofficial but it’s I believe the biggest/primary arch Linux community discord .
In their roles chanel you can pick one to get security pings… major ones are typically also everyone pinged but some have those disabled
You’ll pry #archlinux from my cold dead hands
Wow that’s bad 🫢
Whelp…I’ve REALLY loved EndeavourOS for my laptop, especially because I felt I could mess around with stuff, but maybe this is my call to use something like Fedora or a OpenSUSE variant (I love Tumbleweed dearly).
Nothing against the incredible Arch, but I’m deffos that user who does
> yay > "Build files exist. Do clean build? N" > "View changes? N".ENTER.
I want to learn, but also I’m a bit of a danger to myself if this malware threat is this broad.
Have you heard about the recent fuckups of fedora? fedora is a shitshow.
If you just yolo with yay anyway, you will get compromised on any system you use, ni matter the OS or distro, my dude.
Have you heard about the recent fuckups of fedora? fedora is a shitshow.
Oh really? I guess I haven’t. 😬
Yeah it was late here so I think I was poorly mushing two separate thoughts together there. I meant I was thinking of moving to a distro that isn’t as bleeding-edge for the laptop I’m not updating every single day…But also I should find something that still has a nice large software variety so I stay off AUR.
OpenSUSE has the “Open Build System” which I’ve used for like one package. So that’s pretty neat.
This is really tough because I have two gamers in the family using Nvidia cards I want to help move off of Windows, but I don’t want them running into having to roll back as often as I have or fiddle too much, but I feel like Mint is a little too far behind.
So I was considering the KDE spin of Fedora for them…But yeah, the answer isn’t so easy anymore lol.
Could you elaborate wrt Fedora being a shitshow? It’s my daily driver and I haven’t experienced any kind of instability and (to my knowledge) I have not been compromised.
Opensuse is great, been daily driving it for 1.5 years with no issues (issues were solved by booting an old snapshot and rolling back, updating again 2d later)
At this point, the count stands at 1500+ https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
(hopefully this doesn’t read as blaming the victims instead of the attackers but) I personally don’t think it’s that complicated to read the updates to AUR packages. It’s not any more hard than only commenting after reading the links that people post here instead of just the headlines—which we all do, right?
i wouldnt know where to get the info in the first place. when i use windows update i also dont reed any changelog because that shouldnt be the users job but the suppliers
The whole point of the AUR is that it’s just random people’s code. There is no supplier here. If you don’t know where to find that information, you really shouldn’t be using AUR.
In an ideal world yes, but I needed some software that was only available via AUR and if the official guides tell me I can install it via AUR I will.
that is indeed the official guides’ fault if they’re not in charge of helping maintain the AUR package. not the case for most of the infected packages here other than notably alvr, though.
windows update doesn’t force you to take a look at the changelog. most AUR helpers do so you better bet that it’s important
(btw)
AUR
Play stupid games win stupid prizes I guess.
How do I check if a system has been affected most easily? As far as I have seen it’s related to the npm package atomic-lockfile, so would that be enough?
npm ls atomic-lockfileDang, if only their packages were more up to date maybe this wouldn’t have happened.
This is why I use NixOS
