Arch Linux AUR Malware Campaign Hits Multiple User-Contributed Packages
Arch Linux’s AUR is experiencing a malware incident involving user-contributed packages with malicious commits that attempt to download npm-based payloads during installation. (...)Arch users should not update AUR packages without review. Examine PKGBUILD diffs, check any new .install files, and be cautious if updates introduce npm commands or dependencies unrelated to the software.
Users who recently updated affected AUR packages should review package history, examine executed suspicious install scripts, and treat any unexpected npm-based installation behavior as a possible compromise.
Arch Linux AUR Malware Campaign Hits Multiple User-Contributed Packages
Arch contributors are cleaning up a malware incident in the AUR after suspicious updates appeared across several user-maintained packages.Bobby Borisov (Linuxiac)


sanpo
in reply to Vittelius • • •What a terrible article.
"Multiple" packages mentioned in the title, but they're unable to actually name more than one in the article...
//edit
Actually, they did leave a link to the mailing list thread at the very end.
I should learn to read the entire article...
Bananskal
in reply to sanpo • • •placebo
in reply to Vittelius • • •Why npm and not python? It's installed on every arch system and wouldn't bring unnecessary attention 🤷
lemmyvore
in reply to placebo • • •placebo
in reply to lemmyvore • • •npmas a new dependency. It'd be much easier to sneak in a python script.lemmyvore
in reply to placebo • • •AUR "packages" are just a recipe file that runs some commands that sources packages from somewhere else and builds them then puts them in the format required by the AUR package manager.
Normally it's a source tarball downloaded directly from the project's Git repo. But it can also fetch and install a binary package (for closed source software). Or it can install Node modules, or Python modules etc.
Point is, you can't inject a script directly in AUR itself. You could add the malicious code directly to the recipe file but it would be obvious. You could also download a zip with the malware directly, but it would also be obvious.
So what they do is add the malware to modules published on another platform, and they're downloaded indirectly, as a dependency of the Nth grade.
It's very hard to detect, you can't really notice this kind of attack with a glance at the recipe.
CommanderCloon
in reply to lemmyvore • • •ghost_laptop
in reply to placebo • • •MonkderVierte
in reply to Vittelius • • •Environment variables pointing to /dev/null? Application firewall? Or would just blocking some domain/IP suffice?
Destide
in reply to MonkderVierte • • •sudo {package-manager} remove npm nodejs
sudo {package-manager} purge npm nodejs
npm:
sudo tee /usr/local/bin/npm >/dev/null <<'EOF'
#!/bin/sh
echo "npm is blocked on this system."
exit 1
EOF
sudo chmod 755 /usr/local/bin/npm
npx:
sudo tee /usr/local/bin/npx >/dev/null <<'EOF'
#!/bin/sh
echo "npx is blocked on this system."
exit 1
EOF
sudo chmod 755 /usr/local/bin/npx
Might break somethings but that's a part of boycotting something I guess.
like this
edgarde likes this.
MonkderVierte
in reply to Destide • • •Thanks, but
SolarPunker
in reply to Vittelius • • •