Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AUR packages compromised with Infostealer and Rootkit

discourse.ifin.network

Post reply on HN
Print view View original

21–30 of 234 posts

Re: AUR packages compromised with Infostealer and Rootkit

#21

Post by spystath »

Obviously installing anything from AUR must be done cautiously and there have always been sketchy (as in improperly built/packaged) packages in the past but seeing actively malicious injections is concerning. I think there are two main problems with AUR: 1. it is a remnant of a slightly more egalitarian era in the open source history when you could generally trust 3rd party code and 2. orphaned packages can be adopted by anyone with their full history and vetting intact.

I think we are well past (1) but (2) could be mitigated by tighter controls on AUR accounts and potentially additional safeguards from AUR helpers. Maybe show a big scary warning if the package has changed owners recently. I know there will still be people that will "y" their way forward but it's better than nothing.

Or just avoid AUR helpers altogether and inspect/build the packages you need yourself from their PKGBUILDs directly.

Re: AUR packages compromised with Infostealer and Rootkit

#22

Post by Retr0id »

notabotiswear wrote: post #18
Retr0id wrote: post #11

Earlier quoted context omitted.

This doesn't really have anything to do with npm.

From the Arch mailing list [0] >The result is a rather long list of ~408 packages all doing npm install atomic-lockfile something something [0] https://lists.archlinux.org/archives/list/aur-general@lists....

They could've pip installed, curl|sh'd or anything else, it's not relevant to the underlying issue.

Re: AUR packages compromised with Infostealer and Rootkit

#23

Post by reedlaw »

sph wrote: post #7

Be aware of false positives! I found I had two of these packages installed, clang19 and compiler-rt19, but due to my recent laziness in updating my system, mine were still the versions from July 2025 from the official repos before they had relegated them to AUR. You can check the build and install date with `pacman -Qi `. I run Arch Linux in a container (within Fedora Silverblue), but my plan for the future: - consid…

I also had an affected package installed, fortunately it was from the official repo before it was dropped and became an AUR package.

Re: AUR packages compromised with Infostealer and Rootkit

#25

Post by xx_ns »

This campaign is still ongoing. I just got an email that one of my old packages (which hasn't worked for years and was orphaned for a while) was adopted and immediately a malicious commit was pushed. They seem to be using bun instead of npm now, so any npm-based workaround likely isn't effective.

https://aur.archlinux.org/cgit/aur.git/commit/?h=toggldeskto...

Re: AUR packages compromised with Infostealer and Rootkit

#26

Post by datakan »

sva_ wrote: post #3
UI_at_80x24 wrote: post #2

Here's an easy script to scan for compromised packages: https://cscs.pastes.sh/aurvulntest20260611.sh Not my script. It's easy to read/parse. Never pipe a script directly to bash.

It isn't guaranteed that the list is conclusive. Always check PKGBUILD and sources, AUR is not to be trusted for the most part. I'm actually more surprised that such compromise hasn't happened earlier.

> I'm actually more surprised that such compromise hasn't happened earlier.

This is like the 3rd or 4th time. It's been ongoing and persistent for the last 2 years with frequent AUR downtime as a result.

The AUR should be deprecated in its current state, simply can't be trusted and is a blemish on an otherwise great distro.

Re: AUR packages compromised with Infostealer and Rootkit

#27

Post by datakan »

fooqux wrote: post #16
virajk_31 wrote: post #14

AUR doesn't guarantee security, its upto the user to use AUR & verify before installing anything, its very evident why arch is not used in enterprise solutions.

It's not the AUR. It's the rolling release cycle, and probably even more importantly, lack of support options.

The AUR has absolutely nothing to do with the rolling release cycle

Re: AUR packages compromised with Infostealer and Rootkit

#28

Post by notabotiswear »

Retr0id wrote: post #22
notabotiswear wrote: post #18

Earlier quoted context omitted.

From the Arch mailing list [0] >The result is a rather long list of ~408 packages all doing npm install atomic-lockfile something something [0] https://lists.archlinux.org/archives/list/aur-general@lists....

They could've pip installed, curl|sh'd or anything else, it's not relevant to the underlying issue.

Perhaps there were other vectors, but npm was the one used here.

And yes, this is an AUR issue, but npm being used to host and dissiminate malware is also [a chronic] one, even if separate.

Re: AUR packages compromised with Infostealer and Rootkit

#29

Post by doubled112 »

sph wrote: post #7

Be aware of false positives! I found I had two of these packages installed, clang19 and compiler-rt19, but due to my recent laziness in updating my system, mine were still the versions from July 2025 from the official repos before they had relegated them to AUR. You can check the build and install date with `pacman -Qi `. I run Arch Linux in a container (within Fedora Silverblue), but my plan for the future: - consid…

> Flatpak and Flathub terrify me

I thought Flathub has a review and approval process. Does it fall short in some fundamental way?

Any review process is more than the AUR and NPM are doing.

Post reply on HN