The Arch Linux AUR had over 400 packages compromised with malware

Not panicking, for now, as I don't use npm or have any apps that do. But I agree with the sentiment: Oh dear.

I use Arch, by the wAAAAAAAAAAAAAAAAAAAAAAAAAAAAH!!!!!

Quoting: GrishnakhNot panicking, for now, as I don't use npm or have any apps that do. But I agree with the sentiment: Oh dear.

The hit packages actually pulled in npm, which is then used to grab the malicious bits.

I too have been avoiding stuff that use npm like the plague... turns out it was not an excess of paranoia. 😆

> so it's really quite a shocking security breach to have affected so many different packages.

The methodology of the attacker seems like the most obvious way to attack the AUR. There are 15000+ orphaned packages on the AUR, where anyone can create an account and then adopt packages in mass. Then push updates and wait until someone who has the package installed with their AUR helper, maybe happens to be a bit sleep deprived that day, and just runs an AUR update without inspecting the PKGBUILDs too much.

AUR being user-generated content, unsupported, at your own risk, whatever... aside, this along with the compromised CEMU Linux AppImage makes me feel that the Linux desktop community is in for a real rude awakening when it comes to security that has been neglected in many ways. (even the XZ Utils backdoor was largely targeting servers!)

Quoting: GrishnakhNot panicking, for now, as I don't use npm or have any apps that do. But I agree with the sentiment: Oh dear.

It seems the issue isn't that npm based packages got compromised, but rather npm was added to packages that don't generally need it. They are using npm *IN THE BUILD STEP* not adding it to your system.

Have a look at the list of packages in the thread, they cover a huge range of things.

They also changed the emails to be the same username but on gmail instead of whatever the original maintainers used.
The mailing list has a discussion on how to prevent this in the future. Hopefully some moderation process for adopting abandoned packages or even a limit on how many packages you can adopt in a set period, since the current process of nothing is insane. Adopting 400 packages in one go should be a major red flag for any moderator.

For a quick check if you have any of the affected packages installed, pacman -Qm lists the local packages only, and then depending on the number, either manually ctrl+f them or diff the two lists...

Quoting: mattaraxiaIt seems the issue isn't that npm based packages got compromised, but rather npm was added to packages that don't generally need it. They are using npm *IN THE BUILD STEP* not adding it to your system.

For the malicious packages I saw, the "npm install" was put into a .install file that bundles a hook in the package that gets run after installing a package. So just by looking at the PKGBUILD itself, it's completely fine apart from that addition (and there are packages that do need legit post-install hooks!), and nothing malicious happens when you build the package with makepkg, typically not as root.

It's only when you try to install the package with pacman that it runs the post-install hook... Which happens to run as root! Quite insidious, and I would say this is really clever from the attacker, but in reality it was probably devised by some AI agent with access to the Arch Wiki's packaging documentation...

Quoting: ROllerozxa

Quoting: mattaraxiaIt seems the issue isn't that npm based packages got compromised, but rather npm was added to packages that don't generally need it. They are using npm *IN THE BUILD STEP* not adding it to your system.

For the malicious packages I saw, the "npm install" was put into a .install file that bundles a hook in the package that gets run after installing a package. So just by looking at the PKGBUILD itself, it's completely fine apart from that addition (and there are packages that do need legit post-install hooks!), and nothing malicious happens when you build the package with makepkg, typically not as root.

It's only when you try to install the package with pacman that it runs the post-install hook... Which happens to run as root! Quite insidious, and I would say this is really clever from the attacker, but in reality it was probably devised by some AI agent with access to the Arch Wiki's packaging documentation...

So it *does* run on the system as a hook, not in the build step?

Does it add npm as a dependency to the package then?

Either way though, every Arch user who's installed anything from AUR should look at the list. It's huge and covers a crazy range of things. I think I saw Window Maker and some COSMIC related stuff in there. Also a bunch of Perl and Python stuff that probably make the effective list much bigger, as other things depend on them.