AUR

As an Arch Linux user, I’ve always praised the AUR (Arch User Repository) as one of Arch’s greatest strengths. Actually, it’s one of the reason why so many people recommend Arch. Last month, I found out that over 400 AUR packages were compromised in a massive supply chain attack, leaving me feeling the same frustration many of you probably felt as well. I spent some time researching, running some checks on my system, and figuring out whether my system was affected. What Was Compromised? As far as I know, the attack exploited the AUR’s orphan-package adoption process, where attackers took over packages that had no active maintainer. The malicious code included: npm install atomic-lockfile (malicious npm package v1.4.2) bun install js-digest (second wave payload) Payload stored at: src/hooks/deps Step 1: Checking If I Had Compromised Packages Listing All My AUR Packages # Using yay (AUR helper) yay -Qam > packages_aur.txt Cross-Referencing Against Compromised Packages I downloaded a…