Arch Linux’s AUR is experiencing a malware incident involving user-contributed packages with malicious commits that attempt to download npm-based payloads during installation. (…)
Arch users should not update AUR packages without review. Examine PKGBUILD diffs, check any new .install files, and be cautious if updates introduce npm commands or dependencies unrelated to the software.
Users who recently updated affected AUR packages should review package history, examine executed suspicious install scripts, and treat any unexpected npm-based installation behavior as a possible compromise.
To be fair, basic checks should be done not just make account and in next 10 seconds accept abandoned package and publish malware.
I feel like this always happens to npm specifically. They’re definitely doing something wrong 💀
it’s the way it’s been setup; it needs a thorough revamping to make it as resilient as other supply chains.
not that other chains are bullet proof, it’s just that npm people need to up their game to be atleast as good as the others.
That’s another reason I like cachyos: they have a curated list of aur pkgs in their repo.
Me, a Debian user watching that shitshow 😎
To potentially prevent this entire class of npm attacks in the future, you could edit
/etc/pacman.conf, uncomment# Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup #IgnorePkg =And set it to
IgnorePkg = npmYour system should prompt you to accept installing npm because it’s in the ignore list. These packages set it as a dependency, so that gives you a chance to notice that something’s off and refuse the install. This assumes you don’t already have npm installed or need it for some reason.
edit: word is that
buncommand is being abused as well and may be worthwhile including in the space separated list:IgnorePkg = npm bunI want to call to your attention this article by Marcus Ranum titled “The six dumbest ideas in computer security” and within it, the section #2 on “enumerating badness”.
This is what you try here.
What a terrible article.
“Multiple” packages mentioned in the title, but they’re unable to actually name more than one in the article…
//edit
Actually, they did leave a link to the mailing list thread at the very end.
I should learn to read the entire article…Maybe, just maybe, and nearly unmoderated repository where everybody can create packages, is not so secure after all? /s
And AUR is the reason I keep arch miles away from any of my systems.
You do have the choice to simply not use the AUR. Has nothing to do with using Arch or not.
And no one has ever claimed the AUR to be safe.
yeah, it’s essentially, you want software that’s no the official repo go there.
attempt to download npm-based payloads during installation
Why npm and not python? It’s installed on every arch system and wouldn’t bring unnecessary attention 🤷
this is like the 4th npm vulnerability in months, they used that because npm is shit and easy to exploit
…but Linux is more secure than Windows! /s
this affects only a fraction of arch users, and it would be impossible for it to work on nix systems for example, on top of that, this is basically npm’s fault
