Fake Arch Linux packages push malware with root privileges

[u/Dorian182]

https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/

[u/Suspicious_Punk84]

Don't use AUR unless you know what you are doing.

[u/brewdog_millionaire → u/Suspicious_Punk84]

I have to use AUR for stuff like my VPN but I don't like doing so. Can I check if I've been compromised somehow?

[u/boomboomsubban → u/brewdog_millionaire]

Your VPN likely offers openvpn or wireguard connections, it's not like they should be relying on a homegrown VPN stack.

[u/Mats164 → u/boomboomsubban]

Not always an option. My university uses Cisco AnyConnect with a strange combination of SSO and other requirements. It should be possible to connect with OpenConnect, but as of yet I’ve not been able to get it working. Only option is to use their official client with all its telemetry.

[u/McGuirk808 → u/Mats164]

AnyConnect in an enterprise setting is going to be an entirely different animal.

[u/brewdog_millionaire → u/boomboomsubban]

I believe they offer both, but I use the Wireguard implementation they made

[u/boomboomsubban → u/brewdog_millionaire]

If you don't like doing so, you don't have to.

[u/brewdog_millionaire → u/boomboomsubban]

I'm fine with WireGuard, I prefer it to OpenVPN anyway

[u/Hour_Welcome_2733 → u/brewdog_millionaire]

assuming you are on network manager, you can import wg config and its well integrated into the UI

[u/brewdog_millionaire → u/Hour_Welcome_2733]

I feel like there's been some crossed wires LOL. I use NordVPN and they have an AUR package you have to install

[u/Hour_Welcome_2733 → u/brewdog_millionaire]

You should be able to download a wireguard configuration file from nordvpn which can be imported, though it will be to a specified server/location and not as simple switching

[u/bikes-n-math → u/brewdog_millionaire]

You don't need an AUR package for NordVPN. They have openvpn configs you can download via API and connect on the fly.

[u/brewdog_millionaire → u/bikes-n-math]

I'm fine with using the AUR package, I'm just paranoid about the AUR now LMAO

[u/RemoveMain5596 → u/brewdog_millionaire]

The Chaotic-Aur has nordvpn-bin and nordvpn-gui packages, use them instead of the ones from the Aur...

[u/Standard_Echidna_306 → u/brewdog_millionaire]

read the pkg build. make sure it's downloading stuff only from legitimate sources (in this case your vpns website).

also just quickly glance over it and make sure it's not doing anything weird like trying to run stuff as root. or for example messing with your home directory. packages are built without root using a tool called fakeroot afaik.

as far as knowing whether you're currently compromised im not sure. but going back and reading the pkgbuild you installed is a start

[u/brewdog_millionaire → u/Standard_Echidna_306]

I don't see any glaring red flags, they all look like links from the VPN's domain site. Not sure why I'm being downvoted for asking a question though

[u/The_GreyWarden → u/brewdog_millionaire]

Check if cachyos repo has that package. That's how I use proton pass instead of installing it from AUR.

[u/zerosign0 → u/brewdog_millionaire]

Hmm hate to say this you should always check the AUR src PKGBUILD before installing it. Actually, always download first locally then check the build and the source thing. This what I do even before the malware thing happens. And also try to not always relied on AUR that much

[u/archover → u/brewdog_millionaire]

Re-evaluate your need for that VPN. The few VPN's I used just needed a config file that wireguard loaded, from the package wireguard-tools.

Good day.

[u/steakanabake → u/archover]

its less about needing the config its more of the swapping of vpns for whatever reason. and not needing to keep an up to date repo of all the vpn connections.

[u/archover → u/steakanabake]

I think I agree. The wireguard files are merely re-genned for every VPN provider. Keys and all.

You reference them when you invoke wg-quick <config file>

Good day.

[u/Fun_Wish1844 → u/brewdog_millionaire]

Why do you need the AUR for your VPN?

[u/ArchyDexter → u/Suspicious_Punk84]

definitely that one. It's funny to me how a lot of ppl complain about the aur but brew (MacOS though) gets no attention whatsoever.

Trust by verify.

[u/MarshmallowPop → u/ArchyDexter]

Homebrew is more tightly curated and controlled than the AUR. It's pull request model creates a much higher barrier to entry for malicious actors than the open-door policy of the AUR.

Also, in Homebrew you are downloading a static binary built in a sandboxed CI environment rather than running an untrusted build script locally.

[u/ArchyDexter → u/MarshmallowPop]

Today I learned, thank you kind redditor!

[u/hirak99 → u/ArchyDexter]

I do not use Mac, but I'm guessing somehow it is safer.

If not, (A) it would save been taken advantage of already and (B) that would make front page news.

[u/No-Dentist-1645]

That news article is a bit late to the party, isn't it? That's been a known situation for several months now

And no, AUR packages are not "Arch Linux Packages" in the sense that they are not officially supported or endorsed in any way, so the title is very misleading too

[u/SmallRocks → u/No-Dentist-1645]

It’s in the article. This latest wave of attacks started on the 13th of this month. So, 3 days ago.

[u/shinji257 → u/SmallRocks]

Yes but we have had at least 2 prior attack waves.

[u/SmallRocks → u/shinji257]

I understand but it’s not “late to the party.” The party is still happening.

[u/shinji257 → u/SmallRocks]

Actually this is a new party crasher compared to the previous runs. Before they were adopting old packages. This time they took the approach from the fact that we typo stuff.

[u/BarCouSeH → u/No-Dentist-1645]

There's no such thing as "AUR packages"

AUR is a repository of install scripts, not packages.

The distinction makes a world of a difference.

[u/Regeneric → u/No-Dentist-1645]

You may be right. But Arch without our is useless.

Fedora + Homebrew + FlatPak is a much better choice. Or any other distro + Nix, if you want to have everything.

AUR is the only reason I use Arch

[u/No-Dentist-1645 → u/Regeneric]

But Arch without (AUR) is useless.

It really, really isn't. You can add extra repositories such as CachyOS's which already have thousands more packages, or even the chaotic AUR.

Plus, you can also use homebrew, Flatpak, or Nix in Arch, that much is obvious.

Tons of people use Arch or Arch based distro's without ever touching the AUR. I myself barely touch it, the only AUR packages I have installed on my 3+ year old system are blueberry, zapzap-bin and curseforge. Everything else is in the main repos or on CachyOS's. Even if I wanted to, I could install these packages from outside the AUR, but I don't mind reading the PKGBUILD diffs when they need an update

[u/revken86]

Anyone who chooses to install package "yyay" while trying to install "yay" needs to do more than just read the PKGBUILD...

[u/Silent-Talent → u/revken86]

Yyay! I got the correct Debian build. \s

[u/zombi-roboto → u/Silent-Talent]

$ yassqueen -Suy

[u/_MatVenture_]

These are not "Arch Linux packages"; these are AUR packages. Stop spreading misinformation.

[u/Liarus_]

Yeah the AUR is dangerous, we know, next

[u/setibeings → u/Liarus_]

AUR is fine, or would be if people used it the way it's built to be used. You find your package, you glance at the build files as a sanity check, then you clone the repo and run makepkg.

The part that makes it dangerous is that there are "helpers" that hide all the stuff you should really be checking.

[u/Synthetic451 → u/setibeings]

If a helper isn't forcing you by default to review PKGBUILD diffs on every update, you should probably ditch it for better options.

I still like paru for this reason because out of the box, it will always show you the diff or the full PKGBUILD for new packages. I also like Octopi as a GUI package manager since it is largely just passing through commands to the underlying CLI tool and will show you its complete output.

[u/decho → u/Synthetic451]

If a helper isn't forcing you by default to review PKGBUILD diffs on every update, you should probably ditch it for better options.

It depends.

If you are willing to spend 5 minutes to harden yay then it provides features that paru doesn't (at least to my knowledge) and forcing diff review is 1 line of configuration. More importantly, you can block recently updated packages, urls and packages where the maintainer changed, which is one of the main attack vectors.

If all you cared about is having sane defaults, then you have a point, but I'd argue that if you have time and knowledge to review PKGBUILDs, then you should find time to also configure your helper. I made a post about this recently in case you want to try it yourself, it is super easy.

[u/Scholes_SC2]

Are ai agents good at checking a given AUR package for malware?

[u/surfmaths → u/Scholes_SC2]

They are better than human because they aren't lazy. They will search the web to check if there are any recent report, investigate the PKGBUILD, the provenance of the code and if it match upstream and even check if the author is reputable.

They can also make you a PKGBUILD from scratch for any GitHub repo...

[u/Do_TheEvolution → u/Scholes_SC2]

Of course, arch team itself could run selfhosted models or pay for claude to have basic check done on all AUR packages regularly and on any change and on every submission.

[u/SuccessfulRiver1850]

Great, another AUR Attack

[u/Weary-Savings9795]

Thanks for the warning, I guess, but it isn't the responsibility of Arch Linux devs to be checking 3rd party AUR packages for malware. Arch Linux packages are a different story.

[u/j3dr_]

Since the last security "incident" I avoid AUR as much as possible and, reading news like this, it seems to pay off so far

[u/marcus_autisticus]

This is why we can't have nice things.

[u/hirak99]

I'm more scared of npm than AUR.

[u/quequotion]

If you've been using AUR without a helper, you likely never had a problem.

[u/Linguistic-mystic → u/quequotion]

True dat. I use no helpers, no dependencies from Aur. Never had any problems.

[u/EternityOrb]

Not again

[u/icehuck]

We've done nothing to fix it and we're all out of ideas!!!!!!

[u/gmes78 → u/icehuck]

Account registrations were disabled a while ago.

[u/Flashy_Worry7792 → u/icehuck]

Fix what? Just don’t use the AUR if you can’t be bothered to check the packages you’re adding.

Malware exists on every OS.

[u/icehuck → u/Flashy_Worry7792]

I have a framework laptop. The wiki specifically points me to the AUR to get things working. Broken by design,

[u/Flashy_Worry7792 → u/icehuck]

So go look at the AUR packages you need and verify they are safe?

[u/croxxeur]

How can i see if i have been compromised ?

[u/boomboomsubban → u/croxxeur]

In a specific forty minute period on Tuesday/Wednesday, did you typo while manually installing yay or paru?

[u/BlueGoliath]

Jia Tan still at it I see.

[u/FlameChampion9]

Glad I got off cachyos and went to Fedora. Don't have to deal with this lol!

[u/2eanimation → u/FlameChampion9]

Stupid take. On Cachy, you need the AUR when the package is not in the main repo. What will you do on Fedora when the package is not available? Just not download it? Can do that on Cachy. Check source code before build? Can do that on Cachy.

Don‘t get me wrong, have fun with Fedora. But it‘s not like you mitigated the problem.

[u/FryBoyter → u/2eanimation]

What will you do on Fedora when the package is not available?

As far as I know, Fedora offers significantly more packages through its official package repositories than Arch Linux. Therefore, there’s a higher chance that you’ll be able to install the package you want directly.

And if not, I would search for the package in COPR. Although I doubt that COPR is actually significantly more secure than AUR.

[u/xaocon]

This shouldn't be news. Any person using AUT should assume packages are compromised and not install unless they read everything that's going to happen.

[u/Entheon94]

i think its best to avoid tha AUR at this point i guess?

[u/Woodpecker-Visible]

Defender should be preinstallend on every arch installation. M$ has answered our prayers.

Redditors and their sense of humor is top noch.

[u/No-Dentist-1645 → u/[deleted]]

Because Arch is intended to be a DIY distro from the start, and that includes reading install scripts, there is nothing "wrong" with doing so.

If you think that Arch should be a distro where they hold your hand in every step along the way and where they can't trust their users to do anything by themselves, please see https://wiki.archlinux.org/title/Frequently_asked_questions#Why_would_I_not_want_to_use_Arch?

[u/Jristz → u/[deleted]]

How you can flatpak a Liquirix Linux Kernel?

[u/dividends4life]

After 6 years, I ended up moving to Void because of the AUR. The process needs to be rethought. Even without the malware, the AUR would tend to corrupt my installation over time. The less you use it, the more stable your system.

[u/Damglador → u/dividends4life]

The less you use it, the more stable your system

Installing even 100 AUR packages won't make your system any less stable if all they do is dump a tar.gz into /opt and install a desktop file.

[u/haruame_ → u/dividends4life]

You could've just not used it

[u/la_tajada → u/dividends4life]

Why do people think they have to use the AUR or they aren't using Arch? Comments like this almost make it sound like the AUR is pacman pulling from the official repos.

[u/dividends4life → u/la_tajada]

Say what like, but without the AUR, the Arch repositories are woefully lacking. For me it was the only place I could get my print drivers for my brother printer/scanner, and several other critical packages.

[u/madhaunter → u/la_tajada]

We're reaching a point where a shady piracy website is more trustable than AUR and everyone here seems to think this is perfectly normal

[u/Flashy_Worry7792 → u/madhaunter]

Warning
AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

[u/madhaunter → u/Flashy_Worry7792]

And ?

[u/Flashy_Worry7792 → u/madhaunter]

If you choose to download malware, don’t be surprised when you have malware on your computer.

[u/madhaunter → u/Flashy_Worry7792]

Advertise AUR as malware then and not as a source in the wiki.

But it wouldn't look good right?

Yet it's the truth

[u/Flashy_Worry7792 → u/madhaunter]

Next you’re gonna tell me GitHub is malware.

[u/madhaunter → u/Flashy_Worry7792]

I mean if I follow your logic....

How is it any different than AUR ?

[u/Flashy_Worry7792 → u/madhaunter]

It isn’t and that’s the point.

[u/theriskybusinesscar → u/dividends4life]

Sorry bud, it's not 2012; the opinions of anti-systemd people aren't relevant to anything.

[u/G6L20]

Can't we prevent any fetch from Russian ISP ?