Arch contributors are cleaning up a malware incident in the AUR after suspicious updates appeared across several user-maintained packages.

Arch Linux’s AUR is experiencing a malware incident involving user-contributed packages with malicious commits that attempt to download npm-based payloads during installation. (…)

Arch users should not update AUR packages without review. Examine PKGBUILD diffs, check any new .install files, and be cautious if updates introduce npm commands or dependencies unrelated to the software.

Users who recently updated affected AUR packages should review package history, examine executed suspicious install scripts, and treat any unexpected npm-based installation behavior as a possible compromise.

  • placebo@lemmy.zipEnglish
    6·
    10 hours ago

    But if you look at some of the packages, they explicitly added npm as a new dependency. It’d be much easier to sneak in a python script.

    • lemmyvore@feddit.nlEnglish
      111·
      10 hours ago

      AUR “packages” are just a recipe file that runs some commands that sources packages from somewhere else and builds them then puts them in the format required by the AUR package manager.

      Normally it’s a source tarball downloaded directly from the project’s Git repo. But it can also fetch and install a binary package (for closed source software). Or it can install Node modules, or Python modules etc.

      Point is, you can’t inject a script directly in AUR itself. You could add the malicious code directly to the recipe file but it would be obvious. You could also download a zip with the malware directly, but it would also be obvious.

      So what they do is add the malware to modules published on another platform, and they’re downloaded indirectly, as a dependency of the Nth grade.

      It’s very hard to detect, you can’t really notice this kind of attack with a glance at the recipe.