Attack wave on Arch Linux: hundreds of package descriptions with malware in AUR

The Arch User Repository (AUR) is facing an extensive wave of attacks. Attackers have taken over hundreds of orphaned package descriptions, added malware, and published them in new versions. The Arch maintainers are counteracting with a call for reports and a large-scale deletion campaign to remove malicious updates and block accounts used by the attackers.

The AUR from Arch Linux does not contain packages in the strict sense, but descriptions, so-called PKGBUILDs, with which users can build the packages themselves. If a description is apparently no longer maintained, users can report it, and after a while, it is marked as orphaned. Then, any user can “adopt” the package description and take over its maintenance.

The attackers exploited this mechanism: they took over such orphaned descriptions, added a dependency for the JavaScript package manager npm, and included a step after the actual software installation that brought the npm package “atomic-lockfile” to the system. Atomic-lockfile in turn contained a pre-installation step , which npm followed, executing the file “deps” supplied with the npm package. According to a preliminary (AI-supported) analysis , deps is a credential stealer, malware that reads out various types of access credentials and forwards them to the attacker. “deps” can also establish itself in the system, disguise its presence with sufficient rights, and download further software.

The wave of attacks is a good reason to point out that the Arch User Repository is *not* an official software source for Arch Linux. PKGBUILDs are not checked by the Arch team. AUR users act at their own risk when installing software from the AUR and should check every update themselves.

However, software from the AUR is often installed with specialized programs, so-called AUR helpers. These helper programs automate the sometimes complicated build steps (AUR software is often compiled from source code by the user), so that users need neither time nor special knowledge for installation. This is convenient but tempts users to approve updates without looking, because the AUR helper takes care of all the necessary work anyway, or because they simply don't understand the changes made by the update.

In the current wave of attacks, it was also the case that the changes in the PKGBUILDs themselves only indicated the inclusion of npm and atomic-lockfile. Depending on the affected software, a dependency on npm might not seem suspicious. Users need at least rudimentary knowledge of software development to recognize npm as out of place or to track down atomic-lockfile and discover the actual malware there.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.