AUR Compromised - Almost 2000 packages affected - 20260611

Announcements
21

Yup. That would be fish simply not recognizing that syntax and requiring the extra psub for that kind of scripting.

I had no idea about that. I do not use fish.

Oh I thought I left a link already. Here it is;

22

Well, seems curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh | bash works just fine with the Fish shell. So all is good.

23

I do. Whenever I see ‘bash’ I then type ‘bash’ or even ‘zsh’ before pasting and executing the command…

24

Hello,

Maybe a dumb question, but as many packages in Cachy’s repos come from the AUR, has any of those been compromised?

25

Huh? CachyOS repos include AUR packages? :thinking:

26

Yes, the cachyos repository contains many AUR packages. But as far as I can tell, the lists show no matches.

This is expected, as this kind of attack only works on AUR packages that have been either orphaned by their maintainers or were created with official sounding package names to trick people into using them instead of safe, responsibly maintained packages.

cachyos contains many very popular AUR packages. The chance of them suddenly losing their maintainer and being picked up by a bad actor, and then the malware goes unnoticed long enough to make it past the build process that places the compiled binaries in the cachyos repo are very slim.

27

Thanks a lot for your answer :slight_smile:

28

Thanks for the clarification, @Dirge. Much appreciated.

29

What anti malware would you suggest?

30

Thanks mate, both for the notification and the script!

31

Supply chain attack on a community filled repository and the suggestion in the official forum is to do curl | bash :joy: Exactly my kind of humor.

32

I guess that always depends on who proposes what. @cscs is a very trusted member here, I personally use their scripts without hesitation. Still, you may safely look up the script anytime with

curl -s https://cscs.pastes.sh/raw/aurvulntest20260611.sh | cat

33

Or just visit the link that was posted beforehand and do whatever you wish from there.

The script besides the list of packages and echo is about 15 lines.

You can run it ‘remotely’.

You do not have to nor do you need to run anything at all.

34

Yes, of course I did look into the code by using curl without bash and I really don’t want to dismiss @cscs’ effort here - thanks a lot. But the reason why this problem with AUR exists is that people execute code that they haven’t verified. And the mitigation here is to …execute code that most people won’t verify. I was aiming at pointing out the irony (and the general problem when using OS software), I really don’t want to belittle anyone.

35

Any information about how did this happen? I see a lot of commits under the original author’s name, most of these packages are not even new and weren’t maintained by the same accounts. Did they hack the AUR server?

36

I really like to say “THANKS” for the quick information and response with the testing-script!
Highly appreciated kind of reaction!
Cool …

37

Let’s be honest here and that is while it’s good practice to use common sense it’s no substitute for a good firewall and malware protection.

38

Is it generally a good idea to trust a script like this in the middle of a supply chain attack? What happens if the author’s account has been compromised as well?

39

Pretty sure none of these fixes / scans are on the AUR.

40

It’s a simple bash script, you can just look into it and see what it does, that’s what you should learn to do. If you don’t have any other option paste it into a LLM and have it explained to you “for a beginner”, that’s something these things can do at least. Executing things without understanding always means trusting.