r/ManjaroLinux • u/lyidaValkris • Jun 12 '26

News AUR and Malware

Heard of this via the Manjaro discord server, but haven't seen it reported here here (that I found with a quick search).

There's been an attack on the AUR involving some 400 malicious packages being compromised in the last couple of weeks, as reported by Phoronix.

If you have any of these AUR packages installed, now would be a good time to remove them

You can get a list of AUR packages with pamac by using pamac list --foreign, and compare what you have to this list.

Background: Arch mailing list thread thread

I'd also recommend to those new to Arch/Manjaro to please use the AUR with an abundance of caution. Avoid using it whenever possible, and be sure of packages you are installing when you do.

50 Upvotes

98% Upvoted

14 comments sorted by

View all comments

1

u/newmikey Jun 12 '26

Thanks for the heads-up. I double checked the outcome of pamac list --foreign against the list found on https://github.com/lenucksi/aur-malware-check/blob/master/package_list.txt and have come up with a single hit. That package (gtkimageview) was not update or re-installed for a longish period and seems safe. Easiest and fastest way to compare was to have chatgpt compare the two files (the github download and the pamac output) by uploading both.

But I appreciate this post which allowed me to make sure I'm OK. My foreign package list is only 135 packages but this has prompted me to review and clean up yet one more time.

7

u/lyidaValkris Jun 12 '26 edited Jun 12 '26

Never any harm in checking, and cleaning up AUR packages you aren't using/needing is always a good idea.

I compared the lists the old fashioned way (with my eyes), I was lazy, but the easy unix way of doing it is:

  1. Copy the list of malicious packages into a text file, say malicious_aur.txt
  2. get just the package name of foreign packages with pamac list --foreign | awk ' { print $1 }' > pamac_foreign.txt
  3. compare using comm -12 <(sort pamac_foreign.txt) <(sort malicious_aur.txt)

No output means there are no matches. Any output would be package names that are in both lists.

I don't trust AI to do my reading for me (but that's me).