Greetings, I’m on the AUR mailing list and there has been huge influx of packages that were maliciously taken over today. Please check the PKGBUILD and be wary especially of new npm depencencies, particularly one named “atomic-lockfile”, but there might be others.

The AUR is a relic from a time when the Linux user base was a small percentage of what it is today. I see this mayhem also as a good thing, because the AUR as it is would lead to something far worse as the user space keeps growing.

[image] MrSmartepants: Just look at what happened to the infiltration (CVE-2024-3094) of the XZ compression algorithm. We were probably an hour away from complete system collapse. That is effectively something different, at least in terms of severity. The XZ incident has been an targeted and …

Exactly. At the moment, I guess even someone who doesn’t have that much of experience could vibe code a similiar attack, as it is a pretty low hanging fruit to create some AUR accounts and to take over orphans. It’s a good thing that projects like traur and aurscan already do exist. Also, the amoun…

[image] 1093i3511: actively prohibit the use of external package dependencies (i.e. npm, pip, yarn et. al.). I don’t know how you could do that. These days, a huge amount of applications require those tools to be able to build them. Even repo packages are built with those.

On the bright side, this incident motivated me to learn how to read PKGBUILD files. However, it makes me wonder: how do I actually identify whether a script is safe or contains malicious code?

[image] dirn: how do I actually identify whether a script is safe or contains malicious code? This is a good start: [image] AUR PKGBUILDs Newbie The AUR is one of the safest ways to install software, just because it is so transparent. But it does not tol…

Beat me to it but this was exactly what I was about to post, It’s the source I started out with for verifying PKGBUILDS.

[image] dalto: I don’t know how you could do that. These days, a huge amount of applications require those tools to be able to build them. Even repo packages are built with those. The naming conventions in case of libraries out of the npm or pip registry are already regulated. What I’ve mea…

[image] 1093i3511: Sure, there will be cases of programs written in python or node.js which do need some libraries, but even in those cases, it would be better to handle the dependencies via pacman instead of directly via pip or npm. Just to do it properly, the arch way, with pacman as the prima…

Malicious AUR packages

General system Newbie

dalto June 17, 2026, 4:00pm 374

This is a good start: