I guess I won’t update AUR packages at all for a week or so. As it is still an ongoing event and its uncertain if it is already over.
That github repo not only contains a script to check if you’ve got one of the malicious packages on your system, but also provides an overview of the situation. And some recommendations what to do if you’re affected.
Overall, as the attack vector included identity theft / impersonation of an legitimate kde maintainer via git commit forgery, I’ll order a drink for that maintainer, symbolically. As it is no joke when you’re in the middle of an supply-chain attack and you’re reputation is in limbo, more or less. But luckily that suspicion has been clarified by the arch team that it has been impersonation.
[eosblu@machina Desktop]$ ./maltest.sh
Checking for infected AUR packages (494 total)...
Clean: None of the known infected packages were installed within 48 hours of the campaign.
The link to the script to check for malicious packages in the AUR that I’ve posted early originated from the arch linux discord channel, in case you didn’t trust an private github account that may seem arbitrary and not actually affiliated to the arch dev team directly, which is actually an concern that might raise some eyebrows. I guess that it will be updated in case there are new findings. At least the latest commit is only a few hours old.
[eosblu@machina Desktop]$ bash ./maltest2.sh
Checking for infected AUR packages (1595 total)...
Clean: None of the known infected packages were installed within 2 days of the campaign.
This actually seems like a solid use case for AI. If human moderators can’t manually review every package build, an AI system could at least scan for suspicious patterns like unexpected sed, awk, or in this case NPM usage and flag them for human approval. And with the recent DDoS issues, they might also want to consider a P2P approach.
