For those worried, I found a repo with a collection of up-to-date scripts and package lists to help check for any infections: https://github.com/lenucksi/aur-malware-check
Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
61–70 of 227 posts
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#62Earlier quoted context omitted.
>`rua` and other similar CLIs make it really easy to review the packages before installing them from AUR too, and if you are doing banking on the same computer, you really have no excuse not to review the software you depend on. What review should users do? It appears that, in some cases, these were adding npm as a dependency and installing atomic-lockfile, and in others, these were adding bun and installing js-diges…
> What review should users do? The same sort of review you'd do if a stranger sends over a project and says "compile and run this" and you actually want whatever it's supposed to do, so you start looking through it. > It appears that, in some cases, these were adding npm as a dependency and installing atomic-lockfile, and in others, these were adding bun and installing js-digest That's very suspicious if the package…
I hear you, but consider xz. I'm a professional with decades of experience and I'd be lying if I said I'd have caught that. How long would an audit have taken, realistically? You're not wrong, but I don't think the GP is, either.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#63This is my fear with Linux and privacy - malware that leaks private data while using ie Tor, or other "anonymous" programs.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#64Earlier quoted context omitted.
Idk. Arch does have official repositories that are actively maintained and vetted. AUR is for the vast amounts of random software that isn’t popular or important enough to be officially maintained. I’m not sure how to find a balance. One reason to use Arch is to always have the latest software, especially if you’re gaming. (Need to run very recent kernels, GPU drivers, and DEs to support new graphics cards.) So that’…
There's some big stuff in AUR like the binary VS Code and Chrome, fwiw.
I'm on Kubuntu and I install VS Code using Microsoft's repo and Chrome using Google's repo. Also I do Wine and Docker using their own repos. I can't imagine VS Code or even Chrome being put into the mainstream Kubuntu/Ubuntu repos nor why such a burden should ever be shifted to Canonical.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#65Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#66I’m not on Arch Linux, but I am on NodeJS a lot, which frequently suffers from similar types of attacks. Who is doing package management right these days? Who is doing it securely?
> Who is doing package management right these days? Who is doing it securely?
The malware was limited to package sources that I understand to be disabled by default, if you're using Arch Linux. These package sources carry clear warnings that the packages they provide are controlled by third-parties and entirely unvetted by the distro maintainers. [0][1]
If your assertion is that any package management system that permits the installation of packages that aren't vetted by the maintainers of the -er- OS that uses that package management system is "not doing it securely", then the only one that's even vaguely "doing it securely" is Apple's iOS.
I'm of the opinion that permitting users of a general-purpose computer to install arbitrary software is a good thing, and is pretty much the entire point of a general-purpose computer. I'd call computers that make that effectively impossible "appliances". There's very definitely a place for appliances, [2] but seeking to turn every computer into an appliance is massively destructive.
[0] https://aur.archlinux.org/>
[1] https://wiki.archlinux.org/title/Arch_User_Repository>
[2] Reliable computers that you never have to think about because they simply never fail to perform the useful tasks they were designed to do are great.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#67Earlier quoted context omitted.
> users being warned multiple times that it's vital to review anything before you install it, compared to the official repositories. I think this stance should be re-evaluated. Arch Linux developers are doing a fantastic job and I am personally thankful to them - this is not in any way critical of them. And while I don't see an easy solution here, I just feel that the time of "warning users" is long gone with how muc…
It's definitely a sign that popular packages should be moved from AUR to the official repository. I've got some stuff from AUR simply because it's something I need and that's where it is, and I never really verify it's safe; I just trust it blindly. Clearly a bad idea. I guess I should learn to avoid AUR and when I do use something from it, we more aware it's an exception and I need to check it more thoroughly. That'…
How much work is created (and for who) when a package is moved to the official repository?
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#68So from a quick read, it seems it installed "atomic-lockfile", "js-digest" or "lockfile-js" from npm. A list of affected packages is here [1]. Didn't find any quick info on how to check a system, so I ran the following command to find foreign packages and some date related infos: > pacman -Qmi Check the output against the list of affected packages. Then, you can also grep for those files in various locations: > grep…
I love that even when trying to put malware into Arch Linux AUR, the malware is still distributed through NPM. Legendary platform.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#69Earlier quoted context omitted.
There's some big stuff in AUR like the binary VS Code and Chrome, fwiw.
I'm on Kubuntu and I install VS Code using Microsoft's repo and Chrome using Google's repo. Also I do Wine and Docker using their own repos. I can't imagine VS Code or even Chrome being put into the mainstream Kubuntu/Ubuntu repos nor why such a burden should ever be shifted to Canonical.
Since you are using the official repos thats not an issue. The issue is when the package creator is some rando on the internet.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#70Earlier quoted context omitted.
It's still surprising someone was able to infect so many packages. But I admit I don't really know how AUR works. Can anyone with access simply update anything? Do packages not have owners who check contributions?
> But I admit I don't really know how AUR works It's basically GitHub (in terms of "User's generated content") but tailored and specific to Arch/Arch-derived distributions. Packages have owners, but everything is very "freeform" in general on the AUR. It wasn't uncommon you could be added as a maintainer by just sending a mail to the current maintainer, since it's basically "Hey let me contribute to your repository"…
Yeah, the AUR is basically build scripts for github repos or a link to someones pre-built binary. It suffers from all the same problems that the underlying infrastructure suffers from. You could very easily argue that since github/npm/cargo/ has a supply chain issue so does the AUR.