Did somebody get infected by installing https://aur.archlinux.org/packages/sex ?
this post was submitted on 16 Jun 2026
471 points (98.0% liked)
linuxmemes
31781 readers
1087 users here now
Hint: :q!
Sister communities:
Community rules (click to expand)
1. Follow the site-wide rules
- Instance-wide TOS: https://legal.lemmy.world/tos/
- Lemmy code of conduct: https://join-lemmy.org/docs/code_of_conduct.html
2. Be civil
- Understand the difference between a joke and an insult.
- Do not harrass or attack users for any reason. This includes using blanket terms, like "every user of thing".
- Don't get baited into back-and-forth insults. We are not animals.
- Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
- Bigotry will not be tolerated.
3. Post Linux-related content
- Including Unix and BSD.
- Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of
sudoin Windows. - No porn, no politics, no trolling or ragebaiting.
- Don't come looking for advice, this is not the right community.
4. No recent reposts
- Everybody uses Arch btw, can't quit Vim, <loves/tolerates/hates> systemd, and wants to interject for a moment. You can stop now.
5. 🇬🇧 Language/язык/Sprache
- This is primarily an English-speaking community. 🇬🇧🇦🇺🇺🇸
- Comments written in other languages are allowed.
- The substance of a post should be comprehensible for people who only speak English.
- Titles and post bodies written in other languages will be allowed, but only as long as the above rule is observed.
6. (NEW!) Regarding public figures
We all have our opinions, and certain public figures can be divisive. Keep in mind that this is a community for memes and light-hearted fun, not for airing grievances or leveling accusations. - Keep discussions polite and free of disparagement.
- We are never in possession of all of the facts. Defamatory comments will not be tolerated.
- Discussions that get too heated will be locked and offending comments removed.
Please report posts and comments that break these rules!
Important: never execute code or follow advice that you don't understand or can't verify, especially here. The word of the day is credibility. This is a meme community -- even the most helpful comments might just be shitposts that can damage your system. Be aware, be smart, don't remove France.
founded 3 years ago
MODERATORS
Relatively new Linux user here.
I've seen a few posts about malware on Linux mentioning things called AUR and NPM.
I understand they are package managers? Is that something I have to worry about as a Bazzite user?
npm: Node Package Manager.
AUR: Arch User Repository.
Bazzite is based on fedora not Arch so you don't need to worry.
Not likely. Just know that AUR is user driven and not checked or vetted.
I have like 4 things installed from aur, investigated each one first, and I'm still paranoid about all of them.
A lot of people probably won't like this, but personally I feel like Arch is a terrible OS from an average user's perspective. It offers nothing notable of value to its users, while making sacrifices in critical areas.
Unstable as hell and constantly breaks for no reason. On top of that, it's seriously insecure, as shown on exhibit A. It's not the first time, and it won't be the last.
Why not use Mint, Fedora, Zorin, Pop!_OS, or any of countless Linux distros that work perfectly and don't suffer from Arch's issues?
Note: I'm not an OS developer and mean no hate towards Arch devs or users. I'm simply speaking from a user experience perspective.
"Unstable as hell", "breaks for no reasons", "seriously insecure", other distros "work perfectly". I find this kind of uninformed hyperbole tiring, but probably entirely descriptive of your own user journey. Arch is intended for technical users, not "average users" (Whatever that means), and people should not be recommending that their uninitiated friends start their Linux journey there unless they're prepared and capable of providing technical support. I used Fedora and Ubuntu for decades before moving to Arch a few years ago, and I've never loved an OS more than I love this one. But that's my journey.
Arch is deliberately minimal making it a good base system in the same way Debian or Fedora is. It's smaller, simpler, updates faster than the others and is far more configurable. It is however not built for the average user and most distros built on top of it that try to make it more "usable" are IMO pretty dangerous ideas. I think the only derivative i've tried that was good was SteamOS because they made it Atomic like nix or silverblue.
None of this really has to do with the AUR. That was always labelled as "use at your own risk". And to their credit they caught and addressed the attack within a day of it happening. Still, hosting user PKGBUILDs and leaving it to individual users to audit them is not a secure solution, its just punting on the responsibility.
How is it any more configurable than other distros?
"More easily configurable" would be more accurate, because there's less things that could get in your way. The system is designed to make it as simple as possible from a developers perspective.
Its the same config file designed in the exact same way. The only difference is on Arch the user may know how their system fits together but they very well may not.
Or maybe I can agree with "more configurable" if I shift my perspective of configuration to be taking a default and adding/removing. Because arch users will add a lot of things and pre configured distros wont need to add as many things and maybe that means more configuration is happening. Even though both users can theoretically add and remove the same amount.
My experience is arch is more stable than ubuntu. Broke once in the last 10 years, because of a bug in a package, fixed the system with manual upgrade from live usb in 1h. AUR is not part of the archlinux repositories, it's a community thing with mostly the same security problems every similar package manager has (npm, gems, etc.)
1-1, we did not learn anything except you don't like arch.
You said Ubuntu three times. /s
AUR is supposed the last resort, after distro repos, building from source, Flatpak, and Appimage. Ubuntu's equivalent to the AUR would be PPAs.
Personally, I have fewer problems gaming on Arch than any other I've tried.
Edit: Snap is bad for software freedom. I won't touch Ubuntu anymore; if I use apt, I meant apt and not snap. Hijacking my command is Microsoft-style rug-pulling.
He said Debian 3 times
I had heard that Ubuntu is an old African word for "can't configure Debian"
Why is adoption a thing in this way though? People compare AUR to github which seems very apt, but on Github no-one can come and take over the URL of an abandoned repo for rhemselves, if someone wants to start maintaining and the old owner is MIA, they have to make a fork. Why doesn't AUR work the same way but instead allows anyone to take over any abandoned project with no checks?
It is about updates and duplicate packages are not allowed.
I usually don’t do it, but the user is supposed to check. It’s itself a git repo, so you can see who changed what.
It’s just a build script. There are long and complex ones, but many are short. Easiest ones are just a few lines of shell script + metadata
Real talk for a moment, there isn’t a system alive that currently solves the supply chain attack issue. there’s a trade-off between usability, and security. You can be a secure as you want to be, all it takes is a small accident by one developer in a package that you’re using, even if they’re using gpg signing to accidentally upload A package that’s been tampered. It stinks, but that’s the reality. What I think should be applauded is the thoroughness that the arch developers are going through the repo right now trying to find these packages. I don’t know the specifics, but if they’re like other open source developers, they’re unpaid people doing this out of their love for the software and community. and more than likely, this is a headache on top of headaches that they already have that they’re doing for the love of the community.
Idk how the AUR works but I like that nix fetch the source from the repo and also check its hash from a maintainer provided one. Prevents repo hijacking.
Although it's still pretty much vulnerable if the attacker controls both the nix file and the repo
That wouldn't have fixed the AUR incident because the attacker updated the PKGBUILD which is roughly the same as the nixfile. And there are no packages provided by the AUR, just PKGBUILDs. You always build the package yourself locally.
Every *-git package also fetch it from the repo. The apt analogy is someone haven't been maintaining the nixpkg and then it gets adopted by someone else. Now that someone else change the build script to be malware. So it is no fault of the upstream
Back when I was learning arch they made sure you understood AUR is an option, it was never a good option. Even then the risks were just not worth it.
My understanding the AUR was it was supposed to be a “here’s how I made this work.” But it gets treated as a generic repo all the time so…this.
To be fair aur should be merged with nix or something to share efforts and be cross platform.
There is also appimages, if used as flatimage which uses bubblewrap as sandbox even if there is malware its impact would be minimalized
The very point of AUR is to have it properly installed via pacman
Is this referring to some specific event or is it just a general warning about AUR?
I use AUR for "legacy" NVidia drivers btw
The specific event is the cause for the latest Arch News entry.
I'd just like to interject for a moment. What you're refering to as Berkeley Software Distribution, is in fact, Unix or as I've recently taken to calling it, Ma Bell Berkeley Unix
I use aur, extensively, wasn't impacted by the supply chain attack cause I read the diffs.
Be real for a second,
Did you, or did you not, manage to review a diff, and say "no, that looks fishy".
Do you really think you are immune from compromised binary AUR packages thats being downloaded straight from GitHub? Sure, now it's not only the AUR that's bad, but in the end of the day, a malicious binary did arrive at your computer.
Let's say that you don't use *-bin packages, and only download from compilable source, are you immune from the strategy that the state actor who caused CVE-2024-3094 used to compromise packages?
I'm with Cubit on this one. I updated some AUR packages last week. I always do a quick skim through the pkgbuild, and I always check the diffs with respect to my installed version. Auracle clones the git repo for the package, so it's easy to check. It takes more work and, granted, it's a reason they'll stay outdated for longer. I updated 5/34 foreign packages. The others are just not worth it to update every time. And, personally, I have had PKGBUILDs that looked fishy, forgot the functionality I needed, were badly written, wrong dependencies,... and, after looking for alternatives, I just rewrote myself.
When I learned of the attack I did go and recheck those packages, but they were not impacted... I don't do much node things, so if a node-related package was doing an npm install I might have missed it. But the commit author changing on the git diff I think I would have spotted. So if the attack was more sophisticated and was context dependent, using plausible commands, setting same git committer names, (ab)using files upstream, etc. Then yeah, I might get pwn'ed. But not like this.
Binaries from aur is asking for trouble, unless you absolutely trust the upstream. E.g. Microsoft, Amazon, ... You can clearly see it in the PKGBUILD. With -git packages, you need to be doubly aware, but if I need it, the alternative is I clone and install it myself, so not much security and probably frustration is gained.
The xz attack was on a different level, and if I remember correctly, never hit the arch main repo, by pure chance of not being a target. I trust the arch main repo's. The day a key gets stolen, a lot of people will be impacted, so let's hope this aur thing didn't compromise more high profile maintainers...
Also, we're talking about the AUR, not about upstream. I'm not reading all patches on all main repo packages. And if I wanted to build everything myself I'd be using Gentoo.
I do understand some people don't want to give the time to all these steps, but the alternative for me is just too bad. It's a time/security trade-off for which everyone sets the weights differently.
in the end of the day, a malicious binary did arrive at your computer.
No, it didn't.
I'm not going to lie the aur never made sense to me. If you are going to go to all that trouble why not just package it. Source packages are a thing.
One of its biggest strengths is packing proprietary stuff that can’t be redistributed and using custom download clients.
You can share the PKGBUILD, but not the resulting package. Back in the early Humble Bundle days there were packages to install games from there with dependencies and everything; with a special downloader that could download the installers with a custom downloader and supplied credentials
There are plenty of packages that do this like game data packager. All then fixes i have heard to try to fix the aur is just reinventing main repo packaging again. I really do think what needs to be done is streamline packaging and becoming a maintainer. I say more apprenticeships to strengthen the maintainer pipeline.
The developers themselves are often not the package maintainers. Before a package is published or updated in one of the official Arch repos, it has to be built, tested, and sometimes patched (which is why you see a -1, -2, etc. appended to the package version), in order to work correctly not just on its own but in an Arch system with Arch packages that it is likely to encounter. The process is not as thorough as Debian for example, but it's still the responsibility of the package maintainer. If the package is still in early development, deprecated (e.g. wine32), an out-of-tree kernel module (e.g. xpadneo-dkms), or is meant to be built from the latest available commit (any number of *-git packages), the AUR is a convenient way to share PKGBUILD files rather than have the user build the software manually based on a readme, if it even includes build instructions. The PKGBUILD is then ingested by makepkg, which both configures the environment and builds the software, and outputs a package that can then be installed and managed by Pacman.
The caveat is that packages built from the AUR are not vetted by any package maintainers. They can have bugs, they might depend on outdated or no-longer-existent packages, or might contain malware.
it makes sense to me. remove as much friction from the publishing process as possible, so you get a huge amount of packages. this incident just shows they removed a little too much.
there are so many niche packages on the aur useful to so few people that nobody would go through the official process to properly package, test, and maintain them.
for example: vscodium is a fork of vscode, but microsoft disables the marketplace for it. the vscodium-marketplace package from the aur adds it anyway. i don't think any regular repos have these kind of hacks and patches available.
I found it kinda funny that enabling the marketplace in VSCodium was your example here, given how much of a vector for malware that is itself. It's malware all the way down.
You can download .vsix extensions from the marketplace and import them into VSCodium manually just FYI. And it won't auto update so it will save you next time a supply chain attack inevitably hits and starts infecting new versions. Assuming the downloaded version isn't infected in the first place of course.
load more comments
(5 replies)
Source packages are a thing.
AUR is a repository for source packages (in Arch it's called PKGBUILD) from users. You can write PKGBUILD yourself or just download it from AUR if someone already made it.
It bothers me that the movie this meme is based on removed the head rests. Smh my head.
load more comments
(6 replies)
view more: next ›