Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted

2 months ago by steam_lover to c/archlinux

Jayjader 5 points 2 months ago

I'm starting to think it's time the AUR introduced namespacing packages by the maintainer's AUR username. The single namespace was nice while it lasted, but it seems like we're going to need to get packages based on who's uploading them anyways...

save

path: 0 25106660, hotness: undefined, score: 5, children: 0

IAmYouButYouDontKnowYet 3 points 2 months ago

I wonder why Aur is a target.

You think it's Microsoft related?

save

path: 0 25104554, hotness: undefined, score: 3, children: 2

gid 11 points 2 months ago

Probably because it's an attack vector where the effort required to infiltrate malware is relatively low.

save

path: 0 25104554 25105331, hotness: undefined, score: 11, children: 1

chortle_tortle 6 points 2 months ago

From the mailing list thread:

For the record, those are all new packages (not orphaned packages being adopted). I assume more will come, we'll clean those as soon as possible.

In the mean time stay vigilant, probably refrain from installing freshly pushed new packages from the AUR for now.

Looking over the list it's almost all git/bin versions of files. So they just added a ton of new packages like hexchat-bin that didn't have those versions before and injected malware.

save

path: 0 25104554 25105331 25105556, hotness: undefined, score: 6, children: 0

Valso 1 point 2 months ago

I stopped using AUR long before these packages and before the DDOS attacks. Mostly because I started rewriting the code of different applications to compile with QT5 or GTK3. For that I need the source, not what's uploaded on AUR. Which makes me think why I'm still keeping trizen when I don't even use it. 😆

save

path: 0 25271614, hotness: undefined, score: 1, children: 0

archlinux

@lemmy.ml

The beloved lightweight distro

go to feed...

archlinux

@lemmy.ml

The beloved lightweight distro

go to feed...