In case you’re unaware of this latest email blast re: nefarious AUR updates, here’s what was communicated a few minutes ago:
I just received a slew of notifications about orphaned packages that were adopted and updated replacing the source array with a binary:
monitorets
python-unpackable
python-jaraco.packaging
imeditor
python-aiofile
passbook-git
easywifi-git
python-app_paths
cast_control
python-daemons
python-buildlog-consultant
And here is what happened next 
Good to see. 
Yeah, but apparently there are already hundreds of packages affected. However, some have already been reverted. Stay safe everyone.
Check it here. Got it ftom arch mailinglist
Well… I’m not exactly unsurprised this happen… I am glad my current usecase doesn’t require so many AUR packages, but yeah… it sucks.
It certainly does suck. Perhaps a silver lining is that I’ve adjusted my use case … minimizing AUR packages to the greatest extent practical. Maybe even more as time marches on.
Do we have a list to scan against?
Is is still recommended to use:
I thought adoption was already disabled a month ago. man nothing I read is uniform anymore..
@ArchieLinux and @keescase thanks for the PSA
“currently disabled while we are handling the situation.”
So it is possibly temporary and you may well be correct that they did the same last time.
The key takeaways here, which would apply to all the earlier issues and this new flag, are:
That doesn’t mean don’t use it, because it may well have been adopted or created by a trusted maintainer, perhaps even one of the Arch named “maintainers” (essentially admins). It simply means, beware, and pay attention to all changes made to that package.
And to be clear, I’m not saying that you can just assume everything else is completely safe. Only that recently adopted, and newly created packages are where the key exploit opportunities have been.
Or, you know, just do what you should always be doing and review the package diffs.
It only takes a few minutes to learn how and takes no special skills, knowledge or experience.
I curl ed the latest list from WTAKO and run a simple search for installed packages using the malware.lst:
1panel
1panel-git
accel-ppp
act-runner-bin
aeroftp-bin
agisoft-delighter
agisoft-metashape
agisoft-metashape-pro
agisoft-viewer
ajceverywhere-bin
ampere-git
android-aarch64-libxrandr
android-armv7a-eabi-libxinerama
android-armv7a-eabi-libxmu
android-armv7a-eabi-libxrandr
android-riscv64-libxinerama
android-riscv64-libxmu
android-riscv64-libxrandr
android-x86-64-libxdamage
android-x86-64-libxext
android-x86-64-libxinerama
android-x86-64-libxmu
android-x86-64-libxrandr
android-x86-64-xorgproto
android-x86-libxinerama
android-x86-libxmu
android-x86-libxrandr
animaru
antigravity-appimage
antigravity-cli
archutil
arduino-language-server-noclang-bin
autoadb-git
axolotl-launcher
azerothcore-wotlk-git
bananadashboard-bin
beeper-v4-bin
beets-alternatives
bigwebapp-manager
bili-tools
boringssl-git
boxplayer-bin
calendula
calendula-git
cangjie-nightly-bin
carrot
carrot-git
censawayapp-bin
chandler-bin
cinnamon-no-nemo
claude-desktop-bin
claude-history
codebuddy-ide-cn
command-code
comty-desktop-bin
cronicle
dcat
deeploy-bin
deepskystacker-bin
deskreen-ce-bin-next
dev-janitor-git
devolo-dlan-cockpit
discord-electron-openasar
docker-model-bin
dotdotdot-git
duhh
eden-nightly
editorconfiger
ednition-catapult
exfetch
extract-otp-secrets
fancymumble-bin
fasthex-bin
fastwc-bin
faustus-git
fina
firefox-extension-video-download-helper
firefox-pure
firrtl
franki-os-git
funky-git
garlic-decompiler-gui
gigolo-git
gisp
gitarbor-bin
git-pkgs
glewlwyd
gpu-screen-recorder-ui-kwin-git
grub-customizer-git
guarda-bin
hpr
icloudpd
imago-bin
instawow-bin
isleward
jogl
juicebox-plus-git
keeperfx-git
khiops-covisualization-bin
khiops-visualization-bin
kirill-bin
laravel-bin
lib32-vapoursynth
libfprint-crfpmoc-git
libjxl-metrics
libjxl-metrics-git
linux-lqx
linux-ogc
linuxqq-appimage
linux-vfio
listen1
luna-cli
lyrical-git
magic-context-dashboard-bin
makeuros
mastergo-desktop-bin
mimosa
mingw-w64-libcerf
misskey-notedeck-bin
mongodb-compass-bin
mongrel
monitorets
napcat-qq
netlify-application
network-doctor
nnn-nerd
noctyra-meta
noteey-bin
nuclear-player
oa-git
oa-sdk-git
octoprint
openarc-git
openconnect-sso
opennn-git
openocd-raspberrypi-bin
openvpn-nl
option-term
org-cli
osu-lazer-appimage
pagerduty-short-circuiter
pandoc-eisvogel-template
passhole
pawlette
perl-authen-oath
perl-dist-zilla-plugin-minimumperl
perl-hash-persistent
pgadmin4-server
polytrack
portfolio
portless
postman-agent
ps4rpc-go
pylnker-git
python-atproto-git
python-calgebra-git
python-chatterbot
python-dlib-cuda-git
python-google-cloud-monitoring
python-importlab
python-kicadmodtree-git
python-libipld-git
python-libpysal
python-numkong
python-parallax
python-reals-git
python-roman-numerals
python-split-folders
python-ultraplot-git
qbittorrent-enhanced
qbittorrent-enhanced-nox
qoder-bin
qteasytier
ramses-git
raspi-sump
raze-bin
read-it-later-git
rebased-zh-bin
refurb-git
replay-sorcery
rill
roam
rpi5-uefi-bin
runa-aur
shellcheck-bin-doc
sherpa-onnx
skywire-bin
solv
soundshed-guitar
sparklines
spark-store-tui
src-cli-bin
stable-diffusion.cpp-system
steam-appimage
steamidra-bin
stirling-pdf-desktop-bin
sudo-apt-install-opsec
swarm-desktop
tailwindcss
tangent-bin
terminus
throne
ts2date
ttf-qr-font
tuiview
tuxedo-yt6801-dkms-git
typeless
typeshi
typora-free-with-plugin
typora-plugin
uefi-shell-git
vapoursynth-plugin-soifunc
vbcc-git
vectorchord-immich
veil-host-bin
vicinae-kotoba
volterra-firmware
waterfox-beta-bin
wealthfolio-bin
wiki-go
windscribe-cli-v2-bin
withsecrets-bin
wordpress-studio-git
workbuddy
yaak-bin
zalo-for-linux-bin
zed-binSome of those packages have yellow (cautious) and red flags (confirmed malware)
Why target AUR? Isn’t Arch a niche or a small subset of linux base? Even servers are not based on Arch but rather other distros, like Debian, RedHat/Fedora, openSuse/suse, etc.
If one looks at the packages it seems that the packages which were supposed to be targeted for adoption are all developer or android focused. Are there some frontier AI labs or other critical significant economic actors which are using Arch or one of its derivatives?
It does not make sense to go after such a small user base, by trying to target AUR. I mean what is the motive over here?
I think if anyone has managed web-facing assets for any significant amount of time, they’d be aware that bots and opportunistic actors poke and prod your assets at a constant pace, always probing for that vulnerability that’ll help them open the next door.
Targeting developers is not surprising, because developers will often hold the keys to additional more meaningful assets on their systems.
So basically compromise Arch systems and then make a jump from those systems to the intended target. Just like the OpenAI agent(s) did a few weeks ago.
Would that be a correct characterization?
Because being honest and not being disparaging, our total user base is small compared to other distros.
Yeah that’s basically it, but I would expand “Arch systems” more broadly to any identified opportunity. Arch is merely one of those opportunities.
You know CachyOS? That distro is used even by complete newbies because it was spammed everywhere, despite the fact the distro itself is based on Arch Linux. Arch based distros also top Steam charts, alongside Arch itself. You might think “but that’s only gamers”, yeah, you’re right, but it’s clear that Arch Linux based distros are quite popular among Linux users.
Why not other distros? Well… as far as I know:
I don’t think so. I think it’s just a bunch of clowns just messing with the AUR because they can. Some packages aren’t exactly developer focused. osu-lazer-appimage was one that jumped on me. That’s a game, not a development tool. Admittedly, the AUR has a lot of versions of the game available on it, for some stupid reason, so I am not entirely surprised one of them fell prey to this. But to me that makes it somewhat clear that they are just targeting any package they can. Seems like an automated thing as well.
The AUR, along the OBS from openSUSE, are perhaps the only user-generated and maintained repos that are actively pushed, to some degree, by the official maintainers of a distro. When the official website for your distro has a button to go straight to the user-generated repository RIGHT NEXT to the Download button, when the culture around the distro is quite heavily focused on using the AUR instead of channels that are more officially endorsed by the developers, meanwhile the repository’s security model is based on trust and reading diffs, I’m sorry to say this because I do like Arch Linux, but it was kind of bound to happen, especially now in the age where LLMs can, somewhat, do this type of BS at a moment’s notice automatically.
There’s a discussion here about security models, how to actually prevent such attacks/make them harder to perform, if the AUR even has a place in the modern landscape of packaging on Linux, etc. I’m not going to throw my hat in because I did and my take remains the same: just use whatever the developers tells you to use for your specific distro because that’s probably the most secure way to get whatever you want to get.
Going back to that osu! game as an example: on Linux, the game is distributed from the main website through an AppImage. I just use that. I manually made a .desktop file for it for easy access and I use an AUR package that simply just adds MIME definitions for the various file formats the game uses (all of which are just disguised .zip files). It works fine. It’s more annoying than downloading the setup program and running it like on Windows, I also use the AUR because it’s annoying to add MIME definitions yourself (I’ve done it before and it wasn’t too bad, but it was annoying), but it’s not too bad, I guess…
Much of the focus since the original wave of AUR attacks has been on the injection of binaries into previously well-behaved installation scripts…
Is there much info available about just what some of these nefarious binaries are actually designed to do, functionally?
The idea of being broken into is disturbing enough. I’m just wondering how malicious the intrusions have been thus far in this latest chapter of the security arms race?