Arch Linux’s AUR is experiencing a malware incident involving user-contributed packages with malicious commits that attempt to download npm-based payloads during installation. (…)
Arch users should not update AUR packages without review. Examine PKGBUILD diffs, check any new .install files, and be cautious if updates introduce npm commands or dependencies unrelated to the software.
Users who recently updated affected AUR packages should review package history, examine executed suspicious install scripts, and treat any unexpected npm-based installation behavior as a possible compromise.
I feel like this always happens to npm specifically. They’re definitely doing something wrong 💀
it’s the way it’s been setup; it needs a thorough revamping to make it as resilient as other supply chains.
not that other chains are bullet proof, it’s just that npm people need to up their game to be atleast as good as the others.
To be fair, basic checks should be done not just make account and in next 10 seconds accept abandoned package and publish malware.
That’s another reason I like cachyos: they have a curated list of aur pkgs in their repo.
Me, a Debian user watching that shitshow 😎
To potentially prevent this entire class of npm attacks in the future, you could edit
/etc/pacman.conf, uncomment# Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup #IgnorePkg =And set it to
IgnorePkg = npmYour system should prompt you to accept installing npm because it’s in the ignore list. These packages set it as a dependency, so that gives you a chance to notice that something’s off and refuse the install. This assumes you don’t already have npm installed or need it for some reason.
https://lists.archlinux.org/archives/list/[email protected]/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/
edit: word is that
buncommand is being abused as well and may be worthwhile including in the space separated list:IgnorePkg = npm bunI want to call to your attention this article by Marcus Ranum titled “The six dumbest ideas in computer security” and within it, the section #2 on “enumerating badness”.
This is what you try here.
What a terrible article.
“Multiple” packages mentioned in the title, but they’re unable to actually name more than one in the article…
//edit
Actually, they did leave a link to the mailing list thread at the very end.
I should learn to read the entire article…
