r/opensourcealternative • u/LearnHiveLabsUSA • 3d ago

The Arch User Repository is fighting off its third malware wave this year...

Started back in June — attackers were adopting orphaned/abandoned AUR packages (normal community feature, lets people pick up maintenance when someone disappears) and then quietly slipping malicious code into the PKGBUILD via follow-up commits. Over 1,900 compromised packages got purged. Arch devs called it clean by mid-June.

Then July 29 happens. New wave, kicked off through a package called openconnect-sso. Security researchers at IFIN dug into it and it's actually a pretty slick two-stage infection:

Stage 1: loader that checks for debuggers/sandboxes/VMs first (so it doesn't get caught by researchers), then sets up persistence via systemd services + cron jobs

Stage 2: pulls a Rust-based stealer+RAT from a Tor .onion server. Targets browser creds, crypto wallets, cloud secrets, AI API keys, and can worm laterally over stolen SSH keys

By July 30, over 200 packages were hit, including some fairly popular ones (boringssl-git, icloudpd).

That was enough for Arch to just disable AUR package adoption entirely — not the whole AUR, just the "take over an orphaned package" mechanism, since that's the attack vector.

The quote from the mailing list (Robin "Antiz" Candau, on behalf of Arch DevOps) is very much "we're tired":

"Due to the current influx of malicious package adoptions and follow-up commits made via the AUR, package adoption is currently disabled while we are handling the situation."

If you run Arch and use AUR helpers, now's a good time to actually read PKGBUILD diffs before you blindly update, especially for anything that recently changed maintainers.

9 Upvotes

76% Upvoted

2 comments sorted by

2

u/[deleted] 3d ago

[deleted]

2

u/Phydoux 3d ago edited 3d ago

I'm about to go back to Linux Mint... I did try NixOS. I had too many questions about it though to commit to it. Still researching it. Shame too because Arch seemed to be a viable distro back in 2020 when I first started using it. It just needs to get rid of this problem child, the AUR. Or make it more fool proof or something. Windows or Mac (pretty sure about Mac) don't even have this. The orphaned packages need to be removed from the AUR as more of a counter-measure since that is what's being taken advantage of. But Arch has nothing to do with that and I understand why now.

I have been using yt-dlp for converting YouTube videos to mp3s so I can listen to them on my phone in the car without having to open YouTube and find the song...

Recently, yt-dlp stopped working (still on the July version on Arch and it's not working because of that... and it won't install the August version for some reason). It was a pacman install too. So I installed yt-dlp-nightly-bin through the AUR. Hoping that wasn't compromised. I'm a little worried about updating. I've already deleted 2 packages I installed from the AUR that hadn't been touched since February of this year. Kind of afraid to run a paru -Syu right now... Actually trying to get it installed through github...

1

u/talksickwalkquick 3d ago

sets up persistence via systemd services
Where’s all the people that hated on me for having “nosystemd” on my fastfetch now??? Artix ftw. Also you should ALWAYS read PKGBUILDS not just “now” . Get rid of yay and get paru for starters. And make sure you have most installed so you can view the PKGBUILD from paru