It's as safe as it always was and will be...
The concept of AUR is that you run other persons scripts on your device. That is by definition a very insecure thing to do.
this post was submitted on 26 Jul 2026
14 points (81.8% liked)
Arch Linux
9878 readers
1 users here now
The beloved lightweight distro
founded 6 years ago
MODERATORS
The concept of AUR is that you run other persons scripts on your device. That is by definition a very insecure thing to do.
This boils it down fairly well, I think ๐
I took the incident as a lesson to be more diligent about reviewing the pkgbuild before installing anything. It's understandable that not everyone will be willing to do that and I think the AUR is probably not for them, at least until there is some sort of safeguard in place.
Just manually read the diffs for your yay -Syu. They were adding lines to the PKGBUILDs to pull malware. Verify what each line does and you'll be fine.
It always has been as safe as it always was, assuming you follow basic safety rules. One of them being to read changes, or at least glance at them, but more importantly to not use/install packets that are unmaintained. This possibly includes occasionally checking if those that you have installed are still maintained.
The recent attack has been to take over unmaintained packages, which anyone can do, and use them to inject malware. So only people that had unmaintained packages installed could even be affected. This has not been made impossible. In fact it's mostly unchanged but has been made just slightly harder by requiring (new) aur accounts to have verified mail addresses.
It is kinda hard to really "fix" this, as anyone being able to put packages in the aur is literally the point. So is someone being able to adopt an abandoned package. Changing that would fundamentally alter what the aur is. Maybe it'll eventually be necessary, but what exactly a solution would look like without literally breaking the core idea isn't exactly a trivial question either.
Thanks for all the replies! In a nutshell,
- "Safe" is a relative concept with AUR.
- Most of the affected packages were unmaintained, and probably shouldn't be installed anyway.
- Read the diff's before updating ๐
The situation was under control within the day it was reported. The window where you could've been affected was only a few hours. It was not a case of them "uncovering" thousands of infected packages that were lying around for months. They were noticing an automated attack of hijacking and infecting orphaned packages as it was happening and rushing to keep up while warning the public.
That's not to say the AUR is "safe". Its as safe as its always been. Continue to read your PKGBUILD diff's as you always should have.
What is it you look for in the diffs more specifically?
The first thing to check is that the software is being downloaded from the correct place. Look for additional downloads and make sure they're legit. Look for obfuscated code. If you're not sure, ask.
Not that it is a replacement to doing it manually, but if I were to write a script to look at "important" pieces, what should I be grepping?
You need to look at all the changes or if you are installing it, the whole package build file.
You have to have some expectations and understandings of what the PKGBUILD for the package should be doing and look for something out of the ordinary. The upstream repo will usually have packaging instructions in its readme or wiki which should be reflected in the PKGBUILD.
In the case of the last incident, the attacker was adding npm as a dependency so they could execute npm install atomic-lockfile, which was the actual attack. That was a huge red flag because most of the packages had nothing to do with JavaScript.
Anything that could compromise your security, privacy, anonymity or safety.
Sure but npm isn't
none of the affected packages were popular and iirc all were flagged out-of-date for a long time, which is also why the attackers got access as they were abandoned.
just review pkgbuilds and pay attention to ones that get flagged out-of-date when you're updating and go check it out and find an alternative if the upstream project looks abandoned as well or install it from source instead if it's just the aur pkg.
most out of date aur pkgs i've had ended up being things that the arch team put in extra so i just needed to install that one instead anyway.
another thing to note: after an update, when your aur tool says you have orphaned packages installed, highly consider removing them.
if you want to keep them for whatever reason, try to remember (or write them down) so if they get an update out of the blue, you can scruitinize the pkgbuild
It only takes a few moments to scan the diffs in a pkgbuild. It's not a big ask.
Those headlines were the usual "mention (seemingly) big numbers without context"-bullshit. You can easily look up the actual amount of packages in the AUR...
They also did not "inject malicious code into AUR packages" because of some insecurity that needed fixing. They simply took over orphaned packages then modified them.
So actual reality boils down to:malicious actors took over a miniscule amount of AUR packages with so little public interest nobody even maintained them. And the AUR is as secure as it ever was. Which means not very secure at all because it's public community content without any vetting. So look up the package and actually read the PKGFILE. Just as Arch is vocally warning you.
99.9% of changes are version numbering, checksum and rarely slight dependency changes. There is no chance anyone affected by a long orphaned package that got taken over and modified did ever read that one stupid file of just a few lines (or just the dif provided by several AUR helpers automatically).
They also did not "inject malicious code into AUR packages" because of some insecurity that needed fixing. They simply took over orphaned packages then modified them.
I agree, but I wanted to clarify this point for anyone: they didn't "take over orphaned packages" themselves, they took over the install processes, provided by the AUR for packages, that have likely been abandoned by the maintainers. The AUR doesn't host the actual code for software itself; it's just a set of instructions that tells the client where to grab code from and what to do with it.
The AUR is never safe.
This reads like someone asking whether it's safe to leave your front door unlocked again because he read about a bunch of people using open front doors to rob them.
It never was safe, it never will be safe, you're trading convenience for safety, you're supposed to review the PKGBUILDS to ensure they're safe, if you can't do that you shouldn't risk it.
This is why I hate when Arch (yes, even Cachy or whatever is the current "easy" Arch) is recommended for new users. Arch assumes you know what you're doing, it expects you to read the manual, and it doesn't have kid gloves. You will get hit in the face by this and many other similar things, and will be told "it was in the manual".
This reads like someone asking whether it's safe to leave your front door unlocked again
Fair, and not wrong ๐ Appreciate the reminder!
I would personally still wait until the AUR maintianers give the all clear
All of them?
There is not going to be an all clear. See my longer response as to why.