Greetings, I’m on the AUR mailing list and there has been huge influx of packages that were maliciously taken over today. Please check the PKGBUILD and be wary especially of new npm depencencies, particularly one named “atomic-lockfile”, but there might be others.

True but the difference is the AUR is getting a bad reputuation like this, packages from default repos can get compromised too but is very less likely to happen even though it can. The whole point is the AUR feels more like security liability in it’s current state compared to third-party repos where…

[image] dalto: Can you give an example of something that could change that wouldn’t show up in a diff? Some AUR packages apply patches. If you put the change in the patch, it doesn’t show up in PKGBUILD. Same applies to packages that download and then extract ZIP files from external sources (…

not always, I updated last night and I don’t think I have deleted anything after, I will try to not delete it for a while

[image] Cphusion: The whole point is the AUR feels more like security liability in it’s current state I can go to the Arch Wiki right now and write that after installing Arch you should do a rm -rf /* to check your system after installation. Does that make the Arch Wiki a security liability? …

[image] Schlaefer: I can go to the Arch Wiki right now and write that after installing Arch you should do a rm -rf /* to check your system after installation. Does that make the Arch Wiki a security liability? So your the guy that nuked my computer. :rofl:

To put this all a bit more into perspective it seems also redhat has been comprimised. [image] The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2) Unit 42 analyzes npm supply chain evolution post-Shai Hulud. Discover wormable malware, CI/CD persistence, multi-stage …

[image] Schlaefer: I can go to the Arch Wiki right now and write that after installing Arch you should do a rm -rf /* to check your system after installation. Does that make the Arch Wiki a security liability? There’s a lot more nuance that has to be taken into consideration. That seems over…

[image] Cphusion: That seems over exgarrated because any experienced Linux user will know what that does. You can’t compared reading a malicious PKGBUILD to a bad intended one-liner in the wiki. That was just an example. You can replace that with any other command a user who blindly approves …

[image] khagaroth: Some AUR packages apply patches. If you put the change in the patch, it doesn’t show up in PKGBUILD. The patches would show up in the diffs though, it isn’t only the PKGBUILD. [image] khagaroth: Same applies to packages that download and then extract ZIP files from ext…

[image] Schlaefer: That was just an example. You can replace that with any other command a user who blindly approves a PKGBUILD would also blindly copy from the Arch wiki into the CLI. Sure but since they have been talking about possible solutions that that would do some form of auditing on P…

Malicious AUR packages

General system Newbie

keescase June 12, 2026, 4:18pm 85

To put this all a bit more into perspective it seems also redhat has been comprimised.