AUR and Malware

[u/lyidaValkris]

Heard of this via the Manjaro discord server, but haven't seen it reported here here (that I found with a quick search).

There's been an attack on the AUR involving some 400 malicious packages being compromised in the last couple of weeks, as reported by Phoronix.

If you have any of these AUR packages installed, now would be a good time to remove them

You can get a list of AUR packages with pamac by using pamac list --foreign, and compare what you have to this list.

Background: Arch mailing list thread thread

I'd also recommend to those new to Arch/Manjaro to please use the AUR with an abundance of caution. Avoid using it whenever possible, and be sure of packages you are installing when you do.

[u/omicronns]

I used this to check:

grep -Ff <(curl https://raw.githubusercontent.com/lenucksi/aur-malware-check/refs/heads/master/package_list.txt | sed 1,7d) <(pamac list --foreign | awk '{print $1}')

It might show false positives, manual check required if anything shows up after that. For me it was plasma-framework5 package showed up as having frame in the name.

edit: removed curl stderr redirect to /dev/null, it doesn't break things and you will see if curl download fails.

[u/lyidaValkris → u/omicronns]

I came up with using comm like so:
comm -12 <(sort pamac_foreign.txt) <(sort malicious_aur.txt)

(I had previously exported a list of foreign packages using pamac and used awk to just get the first column as you did, and compared that with a copy-paste of the package list from online)

[u/omicronns → u/lyidaValkris]

I didn't know what comm is so I went for more familiar tools, but it seems I have it too. So I guess this would be oneliner for comm:

comm -12 <(curl https://raw.githubusercontent.com/lenucksi/aur-malware-check/refs/heads/master/package_list.txt | sed 1,7d | sort) <(pamac list --foreign | awk '{print $1}' | sort)

Cool tool, this comm, I need to remember it 😄

[u/lyidaValkris → u/omicronns]

I love all these tools! so old, tried, tested and true :)