Arch contributors are cleaning up a malware incident in the AUR after suspicious updates appeared across several user-maintained packages.

Arch Linux’s AUR is experiencing a malware incident involving user-contributed packages with malicious commits that attempt to download npm-based payloads during installation. (…)

Arch users should not update AUR packages without review. Examine PKGBUILD diffs, check any new .install files, and be cautious if updates introduce npm commands or dependencies unrelated to the software.

Users who recently updated affected AUR packages should review package history, examine executed suspicious install scripts, and treat any unexpected npm-based installation behavior as a possible compromise.

  • lemmyvore@feddit.nlEnglish
    181·
    11 hours ago

    Because the NPM is a complete mess and it’s super easy to exploit for supply-chain attacks by sneaking malware into one of the billion dependencies required by most popular packages.

    • placebo@lemmy.zipEnglish
      5·
      11 hours ago

      But if you look at some of the packages, they explicitly added npm as a new dependency. It’d be much easier to sneak in a python script.

      • lemmyvore@feddit.nlEnglish
        101·
        10 hours ago

        AUR “packages” are just a recipe file that runs some commands that sources packages from somewhere else and builds them then puts them in the format required by the AUR package manager.

        Normally it’s a source tarball downloaded directly from the project’s Git repo. But it can also fetch and install a binary package (for closed source software). Or it can install Node modules, or Python modules etc.

        Point is, you can’t inject a script directly in AUR itself. You could add the malicious code directly to the recipe file but it would be obvious. You could also download a zip with the malware directly, but it would also be obvious.

        So what they do is add the malware to modules published on another platform, and they’re downloaded indirectly, as a dependency of the Nth grade.

        It’s very hard to detect, you can’t really notice this kind of attack with a glance at the recipe.

    • CommanderCloon@lemmy.ml
      2·
      10 hours ago

      But why would they care about supply chain attacks if they already have hacked into the package you’re requesting? In that case, executing python scripts would be less noticeable

      • lemmyvore@feddit.nlEnglish
        32·
        9 hours ago

        Here’s the AUR recipe (PKGBUILD file) for a random package:

        https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=nautilus-git

        This is a standard format for the recipe. It’s Bash code used to define variables and functions.

        You’ll notice there’s no place to sneak in a Python script. There is some brief Bash code in the functions but any major stuff would stand out immediately. So would an command that fetches a malware zip from a weird URL.

        Meanwhile, if you add node or python to the dependencies, and then run a command that installs a perfectly legit npm or pip module, nobody would bat an eye. It’s impossible to figure out that among the many upstream dependencies of that module there might be one that was subverted to discreetly run malware.

        AUR is a very bad idea tbh and should not be used by the faint of heart. It makes it entirely too easy to pull this kind of crap.

        • lofi@piefed.socialEnglish
          1·
          5 hours ago

          AUR itself is fine, the issue in this case is more with the automated system allowing anyone to take over orphaned/abandoned packages. This is a targeted attack leveraging that system.