Libgdata - AUR package compromised

General
1

Hi, there!

I have Arch Linux installed on my second laptop. Recently I checked the list of the package infected on Atomic Arch, and my system has the package libgddata which is on this list.

However, running the command pacman -Qi libgdata, the output says that this package was installed on March 7th by the maintainer Jan Alexander Steffens.

It means this package belonged to the Arch official repos, just before being dropped in AUR repos and the attack as well.

So, did this package infect and compromise my system?

2

No. If any malicious actions were taken on the package it would’ve been after Jan orphaned the package and it being adopted by someone else.

If you never updated it after that happened then you have nothing to worry about.

Out of curiosity, how do you usually update your system? sudo pacman -Syu?

3

Yes, I always update my system running sudo pacman -Syu.

However, I use the AUR helper YAY to install packages which does not exist on Arch repos, and update them using yay -Syua.

I did not installed directly the lidgdata neither running sudo pacman -S nor yay -S. Problably it was installed when I installed any other package. I suppose.

4

All right, thanks. Separating your updates between pacman and yay worked in your favor here since it seems the AUR version of libgdata never made it to you.

Yes, generally any package with “lib” in it will be installed as a dependency for something else. What that something else was I cannot say.

5

At first, I was worried when I checked that this package was installed on my system. But by using the command pacman -Qi and seeing that the maintainer was Jan ‘heftig’ Alexander, my doubt came out.

6

Thanks a lot for your help, buddy!