How to check for compromised packages from the current aur malware attack

Scroll down to #5

https://www.baeldung.com/linux/installed-packages-chosen-repository

Perfect. I’m a bit concerned though - I knew I had Zoom (and Dropbox, which I’d forgotten about), but it’s also listing that Chaotic-aur is also serving up paru, shelly, and some limine packages.

That doesn’t sound right, so I’ll look into that.

 ~  sudo pacman -Syy                                                                                                          
:: Synchronising package databases...
cachyos-znver4                                   96.8 KiB  1423 KiB/s 00:00
cachyos-core-znver4                             108.9 KiB  1472 KiB/s 00:00
cachyos-extra-znver4                              4.3 MiB  32.3 MiB/s 00:00
cachyos                                         514.5 KiB  5.40 MiB/s 00:00
core                                            126.6 KiB   801 KiB/s 00:00
extra                                             8.2 MiB  27.3 MiB/s 00:00
multilib                                        126.5 KiB   766 KiB/s 00:00
chaotic-aur                                     655.5 KiB  1862 KiB/s 00:00

 ~  sudo paclist chaotic-aur                                                                                             
chaotic-keyring 20251028-1
chaotic-mirrorlist 20260428-1
dropbox 250.4.3245-1
fish-autopair 1.0.4-2
limine-mkinitcpio-hook 1.36.0-1
limine-snapper-sync 1.30.1-1
linux-cachyos 7.0.12-1
linux-cachyos-headers 7.0.12-1
linux-cachyos-lts 6.18.35-1
linux-cachyos-lts-headers 6.18.35-1
oh-my-zsh-git r7425.7ed475cb5-1
paru 2.1.0-3
plymouth-theme-cybernetic-git r47.5d881745-1
proton-cachyos-slr 1:11.0.20260601-1
protonplus 0.5.20-1
shelly 2.3.3.2-1
zoom 7.0.5-1

It’s like the priorities are all wrong, and Chaotic-AUR has gotten in front of system packages.

As part of setting up Chaotic AUR you also added it to the list of repos in pacman.conf. It is supposed to sit below all the others in order not to replace official packages with ones from AUR. So, by adding it as a repo, pacman treats it as native.

Yep, so the issue here is the AUR has more up to date versions of these packages and has installed them over the system packages? That’s a problem.

I really prefer it over the regular AUR, especially given how often Zoom updates, but not sure this is worth keeping using if AUR versions of system tools can overwrite like this.

This is very strange. I checked /etc/pacman.conf and chaotic-aur is listed last.

In that file, it states:

# REPOSITORIES

- can be defined here or included from another file
- pacman will search repositories in the order defined here
- local/custom mirrors can be added here or in separate files
- repositories listed first will take precedence when packages
have identical names, regardless of version number

- URLs will have $repo replaced by the name of the current repo
- URLs will have $arch replaced by the name of the architecture

And when I check the package names/versions for paru, they’re identical.

~ sudo paclist cachyos | grep -i paru
paru 2.1.0-3

~ sudo paclist chaotic-aur | grep -i paru
paru 2.1.0-3

So why is paru showing as installed from chaotic-aur??

I am certainly not the best to ask this, since I never actually set up Chaotic AUR myself due to it being treated as native, but I am pretty sure version changes alone has nothing to do with it, as it will only take it from the first repo in line as long as the package name is the same.

I could imagine you either installed it from Chaotic by mistake, or it got dropped from official repos and picked up by Chaotic, or it took over a package you had previously installed from AUR since Chaotic takes priority from being on the repo list, or perhaps a dependency only exists in Chaotic so the main package gets pulled into it… not sure about the last one though. Probably best to look-up pacman documentation for better clarity.

nice to be able to check… all clean for the moment… thx!

I used mingw-w64-sdl2_ttf (infected) for compiling a Windows binary from a game I developed for Linux (pacman clone).

Cleaned up the system:
sudo pacman -Rdd mingw-w64-sdl2_ttf
rm -rf ~/.cache/paru/clone/mingw-w64-sdl2_ttf

Verified:
systemctl list-unit-files --state=enabled
systemctl --user list-unit-files --state=enabled
sudo pacman -Qk
sudo pacman -Vv

Inspected hidden user env hooks
head -n 20 ~/.zshrc ~/.bashrc ~/.profile 2>/dev/null
ls -la ~/.config/autostart/

I’ll clone the official SDL repository directly from GitHub and compile the MinGW development library. That solves it unless Github gets nuked as well :wink:

It is not working anymore.

curl: (22) The requested URL returned error: 404

That is because it is dated.

The event has long passed but the original thread (and resources there) continue to hold up;

Though you might go and check out the current state of the tool related to the broken link - they have updated the tool in various ways.

just FYI, you left an “and” in the third code block