AURpocalypse now: a look at the recent AUR attacks

rvz

Who still uses Arch btw after this?

AshamedCaptain

I'll note that OpenSuse also has Packman which a shitton of people enable (for codecs), has also 'one namespace only' an looser policies than the main distro. I do not think this something you can escape by switching distro.

nickjj

In case anyone missed it, the latest version of yay (v13+) supports being able to skip recently added packages through its new Lua extension system https://jguer.github.io/yay/lua.html#upgrade-selection-hooks . You can control the threshold since it's just user configuration now. A bunch of common yay commands also return back the last updated time of a package thanks to https://github.com/Jguer/yay/pull/2846 .

AquaWeasel

Despite that official Arch repos weren't affected in this attack, I would not recommend using Arch (or any rolling release distro) for anything that requires security. (Imagine if the xz backdoor targeted Arch...) An Arch maintainer that I personally know once admitted that he rarely review upstream changes when bumping package versions. He only does that when the build breaks. I can't blame him for what he did, since it's not reasonable to ask package maintainers to spend all their time on those stuff, especially in this "Age of AI" where more and more software are being aggressively refactored (or rather rewritten) and added more features. What we can do is choosing a stable distro (like Debian) where packages are more thoroughly reviewed, and apply security practices (such as TOTP, sandboxing browsers and video players, etc.) even though they cause inconvenience.

Ferret7446

Devil's advocate, except partially serious. This is a good thing, because the warning about checking everything you download from the AUR, which has always existed, is now actually "enforced". People respond to consequences.

cookiengineer

Note that the AUR attacks were part of the larger miasma worm campaign, gradually trying to gain more control through various package ecosystems since the RedHat prototype campaign. Mitigation Tool: https://github.com/cookiengineer/antimiasma Blog Post with details: https://cookie.engineer/weblog/articles/malware-insights-mia...

cozzyd

I love the smell of npm install malware in the morning.

MintPaw

A side note, isn't package maintenance something that can actually be solved to some extent by LLMs? The prompt would be something like "Clone this repo and build this package while building/bundling as few other packages as possible with minimal code changes." Then set it in a loop on all the packages for a particular system, I don't have experience in package maintenance and would be curious what kind of issues would come up.