# Malicious AUR packages **URL:** \ **Category:** Newbie\ **Created:** [June 11, 2026, 4:37pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095 "2026-06-11T16:37:15Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![jcd](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/jcd/32/128646_2.png) [@jcd](https://forum.endeavouros.com/u/jcd)\ **Post date:** [June 11, 2026, 8:41pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/21 "2026-06-11T20:41:24Z")
Aaaand I gave npm the boot. Turns out I don’t really need it. ---
**Author:** ![bitterhalt](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/bitterhalt/32/77623_2.png) [@bitterhalt](https://forum.endeavouros.com/u/bitterhalt)\ **Post date:** [June 11, 2026, 10:58pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/23 "2026-06-11T22:58:48Z")
I never really used AUR much but I’m starting highly consider building the rest of the stuff I have from source 😂 ---
**Author:** ![Schlaefer](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/schlaefer/32/11917_2.png) [@Schlaefer](https://forum.endeavouros.com/u/Schlaefer)\ **Post date:** [June 11, 2026, 11:00pm UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/24 "2026-06-11T23:00:34Z")
This is a contradicting statement. The AUR is “at your own risk” for the attack surface of the AUR provided install scripts. After that it’s a full stop. ---
**Author:** ![drunkenvicar](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/drunkenvicar/32/112222_2.png) [@drunkenvicar](https://forum.endeavouros.com/u/drunkenvicar)\ **Post date:** [June 12, 2026, 1:17am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/25 "2026-06-12T01:17:53Z")
> [@r0ckhopper](#): > > There’s a thread at aur-general to collate all the reports: > > [https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/) HOLY SH\*T Batman, that’s a huge list of infected(?) packages. Since most are deps I have no idea how to tell if I’m infected. edit: `yay -Ss | grep npm` ? ---
**Author:** ![Peter77](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/p/eb9ed0/32.png) [@Peter77](https://forum.endeavouros.com/u/Peter77)\ **Post date:** [June 12, 2026, 1:25am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/26 "2026-06-12T01:25:41Z")
And here I was proud for getting rid of flatpak thought I’d grab what I needed from the AUR. it’s only about 4 applications but still. this is nerve wrecking. ---
**Author:** ![brucew](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/b/e480ec/32.png) [@brucew](https://forum.endeavouros.com/u/brucew)\ **Post date:** [June 12, 2026, 1:50am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/27 "2026-06-12T01:50:17Z")
As a reminder, ```auto pacman -Qm ``` will give you a list of what you have installed from the AUR. Add a `q` to supress version numbers. ---
**Author:** ![ajgringo619](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/ajgringo619/32/35599_2.png) [@ajgringo619](https://forum.endeavouros.com/u/ajgringo619)\ **Post date:** [June 12, 2026, 3:43am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/28 "2026-06-12T03:43:00Z")
How is this not the top news article on the main Arch site??? ---
**Author:** ![Dinomonster](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dinomonster/32/137219_2.png) [@Dinomonster](https://forum.endeavouros.com/u/Dinomonster)\ **Post date:** [June 12, 2026, 4:49am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/29 "2026-06-12T04:49:08Z")
Because it’s not “The Arch Way”. Because it’s always users fault, as were/are DDoS attacks. And yes I know usage of AUR is at users own risk, but Arch’s team has some need for training on publicity. This rant of mine is simply frustration considering their utter lack of communication and victim blaming. ---
**Author:** ![Bink](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/bink/32/87216_2.png) [@Bink](https://forum.endeavouros.com/u/Bink)\ **Post date:** [June 12, 2026, 4:55am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/30 "2026-06-12T04:55:31Z")
It seems Arch security notifications stopped around mid last year. > **[Advisories - Arch Linux](https://security.archlinux.org/advisory)** The recent vulnerabilities would have been appropriate candidates for entries here. It’s something of a mystery as to why they weren’t mentioned. Perhaps the person/s who had been looking after that section, are no longer able to. ---
**Author:** ![UncleSpellbinder](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/unclespellbinder/32/127055_2.png) [@UncleSpellbinder](https://forum.endeavouros.com/u/UncleSpellbinder)\ **Post date:** [June 12, 2026, 5:19am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/31 "2026-06-12T05:19:26Z")
## Chaotic AUR affected as well… > **[Chaotic-AUR | Packages | Requests | Recompilation | Reports](https://forum.garudalinux.org/t/chaotic-aur-packages-requests-recompilation-reports/26/1238)** > > Probably don’t update AUR packages for a couple of days! Unless you review them closely! exodus-wallet-bin, runescape-launcher, python-pychromecast-git, ttf-material-design-icons-git, cgminer, nextcloud-git, thunar-nextcloud-plugin,... ---
**Author:** ![ajgringo619](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/ajgringo619/32/35599_2.png) [@ajgringo619](https://forum.endeavouros.com/u/ajgringo619)\ **Post date:** [June 12, 2026, 5:49am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/32 "2026-06-12T05:49:14Z")
They must be completely overwhelmed with all of the attacks; seems like it’s been non-stop for a couple of years now. I wonder if everyone involved with Arch is a true volunteer, because they could really use a paid publicist to handle these types of crises. While I agree that they could use some training, I don’t think it would be enough. ---
**Author:** ![r0ckhopper](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/r0ckhopper/32/51768_2.png) [@r0ckhopper](https://forum.endeavouros.com/u/r0ckhopper)\ **Post date:** [June 12, 2026, 7:55am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/34 "2026-06-12T07:55:24Z")
> [@UncleSpellbinder](#): > > Chaotic AUR affected Thankfully the Chaotic AUR managed to catch them in time, but the warning about other packages from the AUR not in the Chaotic AUR applies: > **[Attack wave on AUR packages](https://forum.garudalinux.org/t/attack-wave-on-aur-packages/48124)** > > Hey everyone, Just as a heads-up, we are aware of the wave of current injections of malicious content in AUR packages. Our security measures in chaotic-aur are working perfectly so far and have already prevented a few of them from getting... ---
**Author:** ![r0ckhopper](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/r0ckhopper/32/51768_2.png) [@r0ckhopper](https://forum.endeavouros.com/u/r0ckhopper)\ **Post date:** [June 12, 2026, 7:57am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/35 "2026-06-12T07:57:48Z")
> [@Canoe](#): > > To be very clear, even reading pkgbuilds will not protect you True, but in these cases the addition of npm is visible and an enormous red flag 🟥 ---
**Author:** ![cactux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/cactux/32/134907_2.png) [@cactux](https://forum.endeavouros.com/u/cactux)\ **Post date:** [June 12, 2026, 8:01am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/36 "2026-06-12T08:01:45Z")
Assumed “Guilty Until Proven Innocent” when it comes to AUR. That is, make sure the PKGBUILD is “Innocent”. Make sure the code you are building from is “Innocent”. Now, it will come along someone to remind that, well, that is true about all software. Even those in the official repos where the code is not audited. I know. That only makes the “innocent assumption” that some may have to be safe an secure running a system running on open source software totally irrational. In much simpler wording, we may all be toasted at one point in time or another and perhaps without even knowing it. ---
**Author:** ![Schlaefer](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/schlaefer/32/11917_2.png) [@Schlaefer](https://forum.endeavouros.com/u/Schlaefer)\ **Post date:** [June 12, 2026, 8:29am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/37 "2026-06-12T08:29:53Z")
_Yeah, you should always check the pkgnbuild even if updating._ Is is such a fine statement. On days like this it feels attaching qualifiers to the million things that it doesn’t do and can’t be controlled by the user isn’t sending the right message. ---
**Author:** ![mihalycsaba](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/mihalycsaba/32/70916_2.png) [@mihalycsaba](https://forum.endeavouros.com/u/mihalycsaba)\ **Post date:** [June 12, 2026, 8:44am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/38 "2026-06-12T08:44:10Z")
Any info about how did this happen? So many packages with different maintainers and the commits seem to be under the long time maintainer’s name. Most of these packages are not even new. ---
**Author:** ![bitterhalt](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/bitterhalt/32/77623_2.png) [@bitterhalt](https://forum.endeavouros.com/u/bitterhalt)\ **Post date:** [June 12, 2026, 8:47am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/39 "2026-06-12T08:47:53Z")
Not Arch way, NOT OUR FAULT YOU STOPID n00b!!?!1! But still they share huge link to AUR 🤣 ![image](https://forum.endeavouros.com/uploads/default/original/3X/1/1/1145bc5946ead1cf3bd2cc9109c3e239950133d3.png) ---
**Author:** ![r0ckhopper](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/r0ckhopper/32/51768_2.png) [@r0ckhopper](https://forum.endeavouros.com/u/r0ckhopper)\ **Post date:** [June 12, 2026, 8:50am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/40 "2026-06-12T08:50:52Z")
> [@mihalycsaba](#): > > Any info about how did this happen? This report says that it is orphan packages that have been hijacked: > **[Atomic Arch npm Campaign Adds Malicious Dependency](https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency)** > > Sonatype researchers uncovered Atomic Arch, a supply chain attack targeting orphaned AUR packages. Learn how attackers are hijacking trusted projects. But it’s all a bit hazy right now 😕 It would be great if after the fire is out, the Arch Linux maintainers do a full debrief on what happened and what steps they have taken to prevent/impede it happening again. But communication isn’t one of their strengths… ---
**Author:** ![jcd](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/jcd/32/128646_2.png) [@jcd](https://forum.endeavouros.com/u/jcd)\ **Post date:** [June 12, 2026, 8:51am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/41 "2026-06-12T08:51:06Z")
I know at least one instance where the attacker used the former maintainer’s old clear name as user name. ---
**Author:** ![Dinomonster](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dinomonster/32/137219_2.png) [@Dinomonster](https://forum.endeavouros.com/u/Dinomonster)\ **Post date:** [June 12, 2026, 8:57am UTC](https://forum.endeavouros.com/t/malicious-aur-packages/80095/42 "2026-06-12T08:57:42Z")
This has always been mind boggling for me too. Like why? And if it’s big no no, why create option for something like AUR in first place? It’s like Debian would have link to unofficial repo on their front page and then they declare that it’s completely not supported or maintained by the project. 🫪 [Previous page](https://forum.endeavouros.com/t/malicious-aur-packages/80095.md?page=1) [Next page](https://forum.endeavouros.com/t/malicious-aur-packages/80095.md?page=3)