A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems.
  • Tetsuo@jlai.luEnglish
    29·
    1 day ago

    Ok, but I was expecting something a bit more automated then opening a list of package in kate and comparing it to my list of installed AUR package… Plus it’s 400 package so that’s a lot of things to check and plenty of space to miss one package by manually checking.

    But I get it I’m lazy and just need to script something myself. This is affecting so many people I thought we would have a script to check quickly if you are “infected”.

    Edit : thanks for the numerous script sent as reply ! But I’m all set now, thanks !

    • wonderingwanderer@sopuli.xyzEnglish
      5·
      1 day ago

      It’s at the bottom of the doc:

      echo "Checking for infected AUR packages (${#INFECTED_PKGS[@]} total)..."
echo

found=()
for pkg in "${INFECTED_PKGS[@]}"; do
    if pacman -Qi "$pkg" &>/dev/null; then
        found+=("$pkg")
    fi
done

if [[ ${#found[@]} -eq 0 ]]; then
    echo "Clean: none of the known infected packages are installed."
else
    echo "WARNING: ${#found[@]} infected package(s) found:"
    for pkg in "${found[@]}"; do
        echo "  - $pkg"
    done
fi

      Not sure why it uses -Qi instead of -Qm since there’s no point in scanning pacman packages, but I’m no expert

    • Holytimes@sh.itjust.worksEnglish
      71·
      2 days ago

      how many aur packages do you have? Most people i know have like AT MOST 20 or so packages from the aur. Which takes less then 2 mins to manually check against the list.

      • BurgerBaron@quokk.auEnglish
        2·
        1 day ago

        I try to not use any, I have 6 and 4 of those are maintained by the developer, not some rando.

        One I really dislike is that CachyOS when you install their gaming software bundle…it uses the AUR version of Heroic Games Launcher instead of their own repo and CachyOS does not maintain the Heroic AUR AFAIK. I guess because AUR updates more frequently than their own repo? I think it’s bad practice.

      • Kjell@lemmy.worldEnglish
        1·
        1 day ago

        I have much more than 20 packages in aur, most of them are dependencies from steam-native-runtime. Since steam is popular, I can understand that many have more than 20 packages.

        Now when I was reading the ArchWiki I saw that it is mentioned as an alternative, so I assume I can remove steam-native-runtime and all dependencies. Perhaps the instructions have been updated or I googled for instructions and found another page. But there could be other popular packages with many dependencies.

      • Tetsuo@jlai.luEnglish
        1·
        2 days ago

        I’m not home for a few days so I can’t check yet.

        But I think I have something like 3/4 packages at the most.

        But I need to compare that to a 400+ list I’m not sure I agree with you it’s that easy to do rigorously.

        • shelf@piefed.socialEnglish
          1·
          23 hours ago

          you only need to check your 3 or 4 packages to see if they were installed/updated during a certain date range.

          • Tetsuo@jlai.luEnglish
            1·
            23 hours ago

            Considering I haven’t been home since the 6th of June, I assume I probably couldn’t have been infected. But I will still do a thorough check when I get home next week.

        • hoppolito@mander.xyzEnglish
          5·
          2 days ago

          Not sure I understand - if you only have 3-4 packages you can just search for them specifically in the long list?

          Even if you have 50 or 100s of packages, bash makes it pretty doable

          comm -12 <(sort -u file1.txt) <(sort -u file2.txt) > common.txt

          Should spit out only the packages appearing in both lists (done by memory so may not be 100%)

    • NebulaNymph@programming.devEnglish
      3·
      2 days ago

      I haven’t used kate but does it not have some sort of easy search?

      ex. pacman -Qm to list AUR packages; should display the 3/4 pkgs you have installed. Then just search in kate for those 3/4 results?

      Alternatively cat & grep in the terminal is pretty straight forward.

      That is if it’s 3/4 pkgs that are from AUR, but if someone has hundreds installed that is a bigger issue on its own.

      • Tetsuo@jlai.luEnglish
        23·
        2 days ago

        Am I missing something ?

        Just because I have 3/4 package on my system doesn’t mean the 400+ list of affected package gets shorter on the other side…

        I’m actually pretty cautious with AUR and I only install them when there is no other options.

        • m4ylame0wecm@lemmy.zipEnglish
          9·
          2 days ago

          Especially for a small list, 3-4, that you actually need to check, what’s the actual issue? Open list of 400, ctrl+f for the few names you care about, move on.

        • shweddy@lemmy.worldEnglish
          5·
          2 days ago

          I was just curious because I didnt think it was so tediuous to check against an alphabetical list on a website using ctrl+f. But thats just me. It took me less than a minute to check my 8 aur packages against the list