# Malicious AUR packages **URL:** \ **Category:** Newbie\ **Created:** [June 11, 2026, 4:37pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095 "2026-06-11T16:37:15Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![jcd](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/jcd/32/128646_2.png) [@jcd](https://forum.endeavouros.com/u/jcd)\ **Post date:** [June 11, 2026, 4:37pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/1 "2026-06-11T16:37:15Z")
Greetings, I’m on the AUR mailing list and there has been huge influx of packages that were maliciously taken over today. Please check the PKGBUILD and be wary especially of new npm depencencies, particularly one named “atomic-lockfile”, but there might be others. ---
**Author:** ![Bink](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/bink/32/87216_2.png) [@Bink](https://forum.endeavouros.com/u/Bink)\ **Post date:** [June 11, 2026, 4:45pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/2 "2026-06-11T16:45:44Z")
Thank you for the heads up @jcd. That’s something to keep an eye on. ---
**Author:** ![cactux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/cactux/32/134907_2.png) [@cactux](https://forum.endeavouros.com/u/cactux)\ **Post date:** [June 11, 2026, 4:47pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/3 "2026-06-11T16:47:11Z")
![](https://forum.endeavouros.com/uploads/default/original/3X/9/4/94bfe6a6f70c8108fde7c3aa88f0e8f7e206c073.gif) ---
**Author:** ![MyNameIsRichard](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/mynameisrichard/32/111876_2.png) [@MyNameIsRichard](https://forum.endeavouros.com/u/MyNameIsRichard)\ **Post date:** [June 11, 2026, 4:47pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/4 "2026-06-11T16:47:48Z")
Yeah, you should always check the pkgnbuild even if updating. ---
**Author:** ![ajgringo619](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/ajgringo619/32/35599_2.png) [@ajgringo619](https://forum.endeavouros.com/u/ajgringo619)\ **Post date:** [June 11, 2026, 4:50pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/5 "2026-06-11T16:50:00Z")
It looks like the pattern is to add an infected package with **npm** ; maybe removing/blacklisting that would be enough for now. ---
**Author:** ![UncleSpellbinder](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/unclespellbinder/32/127055_2.png) [@UncleSpellbinder](https://forum.endeavouros.com/u/UncleSpellbinder)\ **Post date:** [June 11, 2026, 4:51pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/6 "2026-06-11T16:51:01Z")
### “A huge influx of packages that were maliciously taken over today” This seems like news that Arch should be sharing with the entire Arch community. Not just those who’ve signed up to the AUR mailing list. ---
**Author:** ![cactux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/cactux/32/134907_2.png) [@cactux](https://forum.endeavouros.com/u/cactux)\ **Post date:** [June 11, 2026, 4:56pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/7 "2026-06-11T16:56:15Z")
You use AUR, you are on your own! ![image](https://forum.endeavouros.com/uploads/default/original/3X/5/7/57571e0d0b5674f051f8bebd666ac5fc3b074f64.png) [You’ve been warned!](https://wiki.archlinux.org/title/Arch_User_Repository) ---
**Author:** ![jcd](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/jcd/32/128646_2.png) [@jcd](https://forum.endeavouros.com/u/jcd)\ **Post date:** [June 11, 2026, 5:03pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/8 "2026-06-11T17:03:08Z")
Yeah, it looked like a much smaller amount than what it actually was until recently. I have zero authority of speaking for Arch or the AUR. I just read mails and noticed and thought I tell my endeavourous friends over here. ---
**Author:** ![jcd](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/jcd/32/128646_2.png) [@jcd](https://forum.endeavouros.com/u/jcd)\ **Post date:** [June 11, 2026, 5:13pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/9 "2026-06-11T17:13:13Z")
We need this meme but with “PARU!!!” 😃 ---
**Author:** ![keescase](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/keescase/32/114900_2.png) [@keescase](https://forum.endeavouros.com/u/keescase)\ **Post date:** [June 11, 2026, 5:19pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/10 "2026-06-11T17:19:20Z")
Well I think it is at the least a bit ironic that ARCH warns the user about the AUR and yet sends out messages like this. > **[Arch Linux - News: NVIDIA 590 driver drops Pascal and lower support; main...](https://archlinux.org/news/nvidia-590-driver-drops-pascal-support-main-packages-switch-to-open-kernel-modules/)** ---
**Author:** ![UncleSpellbinder](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/unclespellbinder/32/127055_2.png) [@UncleSpellbinder](https://forum.endeavouros.com/u/UncleSpellbinder)\ **Post date:** [June 11, 2026, 5:19pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/11 "2026-06-11T17:19:55Z")
I joined the AUR mailing list; the emails are starting to come in. Here’s one that just hit my inbox… ![j](https://forum.endeavouros.com/uploads/default/original/3X/3/1/31b1b2e6bbc410af6c1fc78d7fa1532692f97f33.png) ---
**Author:** ![keescase](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/keescase/32/114900_2.png) [@keescase](https://forum.endeavouros.com/u/keescase)\ **Post date:** [June 11, 2026, 5:24pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/12 "2026-06-11T17:24:35Z")
Here you can find a list of those mails. > **[Aur-general - lists.archlinux.org](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/)** ---
**Author:** ![SCORPION2000](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/scorpion2000/32/39398_2.png) [@SCORPION2000](https://forum.endeavouros.com/u/SCORPION2000)\ **Post date:** [June 11, 2026, 5:33pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/13 "2026-06-11T17:33:24Z")
Yeah another reason thy should add some kind of filter to auto scan files that being uploaded and does that are already in AUR and put all findings in a quarantine list for trusted people to review before being allowed in AUR. Thanks for info. ---
**Author:** ![r0ckhopper](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/r0ckhopper/32/51768_2.png) [@r0ckhopper](https://forum.endeavouros.com/u/r0ckhopper)\ **Post date:** [June 11, 2026, 5:37pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/14 "2026-06-11T17:37:11Z")
> [@MyNameIsRichard](#): > > you should always check the pkgnbuild even if updating. AUR PKGBUILDs should be treated as potential unexploded bombs 💣 > [@ajgringo619](#): > > **npm** ; maybe removing/blacklisting that would be enough for now npm packages should be treated as highly infectious - nuke them from orbit just to be sure ☢ ---
**Author:** ![jcd](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/jcd/32/128646_2.png) [@jcd](https://forum.endeavouros.com/u/jcd)\ **Post date:** [June 11, 2026, 6:11pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/15 "2026-06-11T18:11:39Z")
Yeah, something like that is being discussed, but they also want to avoid multiplying the workload for the current admins/mods. And then there’s the question of who is a trusted user? How does one become a trusted user? BTW some of these packages have been overtaken by accounts using old usernames or realnames of their former owners. ---
**Author:** ![jcd](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/jcd/32/128646_2.png) [@jcd](https://forum.endeavouros.com/u/jcd)\ **Post date:** [June 11, 2026, 6:14pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/16 "2026-06-11T18:14:02Z")
I would prefer not having npm on my system at all. But I didn’t pull through yet. ---
**Author:** ![keescase](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/keescase/32/114900_2.png) [@keescase](https://forum.endeavouros.com/u/keescase)\ **Post date:** [June 11, 2026, 6:31pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/17 "2026-06-11T18:31:27Z")
It seems the AUR is not the only one that has been compromised. > **[DistroWatch.com: Put the fun back into computing. Use Linux, BSD.](https://distrowatch.com/weekly.php?issue=20260608#news)** > > News and feature lists of Linux and BSD distributions. ---
**Author:** ![r0ckhopper](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/r0ckhopper/32/51768_2.png) [@r0ckhopper](https://forum.endeavouros.com/u/r0ckhopper)\ **Post date:** [June 11, 2026, 6:40pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/18 "2026-06-11T18:40:49Z")
> [@jcd](#): > > I would prefer not having npm on my system at all. I absolutely refuse to have it on any of my systems 🚫 > [@keescase](#): > > It seems the AUR is not the only one that has been compromised. npm is inherently unsafe 🚫 ---
**Author:** ![r0ckhopper](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/r0ckhopper/32/51768_2.png) [@r0ckhopper](https://forum.endeavouros.com/u/r0ckhopper)\ **Post date:** [June 11, 2026, 6:42pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/19 "2026-06-11T18:42:29Z")
There’s a thread at aur-general to collate all the reports: > **[AUR REPORT THREAD - Aur-general - lists.archlinux.org](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/)** ---
**Author:** ![xircon](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/xircon/32/9124_2.png) [@xircon](https://forum.endeavouros.com/u/xircon)\ **Post date:** [June 11, 2026, 8:03pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/20 "2026-06-11T20:03:25Z")
Luckily the only thing I had that depends on npm was zed (which I never use). Uninstalled and a dummy npm file placed and chattr +i, so if I miss it it will not install. [Next page](https://forum.endeavouros.com/t/malicious-aur-packages/80095.md?page=2)