Arch Linux’s AUR is experiencing a malware incident involving user-contributed packages with malicious commits that attempt to download npm-based payloads during installation. (…)
Arch users should not update AUR packages without review. Examine PKGBUILD diffs, check any new .install files, and be cautious if updates introduce npm commands or dependencies unrelated to the software.
Users who recently updated affected AUR packages should review package history, examine executed suspicious install scripts, and treat any unexpected npm-based installation behavior as a possible compromise.
I feel like this always happens to npm specifically. They’re definitely doing something wrong 💀
it’s the way it’s been setup; it needs a thorough revamping to make it as resilient as other supply chains.
not that other chains are bullet proof, it’s just that npm people need to up their game to be atleast as good as the others.
Could happen with pip too.
To potentially prevent this entire class of npm attacks in the future, you could edit
/etc/pacman.conf, uncomment# Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup #IgnorePkg =And set it to
IgnorePkg = npmYour system should prompt you to accept installing npm because it’s in the ignore list. These packages set it as a dependency, so that gives you a chance to notice that something’s off and refuse the install. This assumes you don’t already have npm installed or need it for some reason.
edit: word is that
buncommand is being abused as well and may be worthwhile including in the space separated list:IgnorePkg = npm bunI want to call to your attention this article by Marcus Ranum titled “The six dumbest ideas in computer security” and within it, the section #2 on “enumerating badness”.
This is what you try here.
deleted by creator
this is like the 4th npm vulnerability in months, they used that because npm is shit and easy to exploit
deleted by creator
Me, a Debian user watching that shitshow 😎
To be fair, basic checks should be done not just make account and in next 10 seconds accept abandoned package and publish malware.
… how do i make npm generally not work on Linux? I don’t use it and with how attack vectors are the majority of cases via NPM… and can be shipped as a binary to <arbitrary temp location>.
Environment variables pointing to /dev/null? Application firewall? Or would just blocking some domain/IP suffice?Maybe, just maybe, and nearly unmoderated repository where everybody can create packages, is not so secure after all? /s
And AUR is the reason I keep arch miles away from any of my systems.
Nobody ever says the AUR is safe. In fact they say specifically that it’s not; for exactly the reasons you mention.
That’s why it’s the Arch USER Repository. You take your fate in your own hands when you choose to use it.
As for your comment about using a distro that has everything in the main repo? How so? Every flavour has software that isn’t included in the main repos. For Arch based systems, that means either the AUR or Flatpaks. For Debian based systems, that means adding new repos to your sources, which is exactly as unsafe as the AUR in most cases, or using Flatpaks.
If you’ve ever added a repo on Ubuntu, than you’ve essentially used their version of an AUR. The end result is no different.
…but Linux is more secure than Windows! /s
It is. And we don’t have spyware installed by default by our OS.
You run the same risks downloading torrents of games or porn on whatever OS you use. This isn’t really linux related, it’s related to downloading unverified files uploaded by random people online, which is what the aur basically is.
this affects only a fraction of arch users, and it would be impossible for it to work on nix systems for example, on top of that, this is basically npm’s fault
Technically there is no such thing as a “completely secure system”
What Linux offers is the fact that by nature of being FOSS, there are millions of eyes on source code at any one time, and so potential exploits can usually be spotted and mitigated faster than waiting for the software maker to fix their own shit. And the fact that, in most cases with Windows, the call is coming from inside the house, so-to-speak; It’s the operating system itself that is malicious and anti-user.
To put it simply: Yes…linux can be attacked just like windows. But we live in an open-concept house with no hidden corners, and we’ve got a pretty great neighbourhood watch thing going on. Versus Windows users who live a house filled with cameras and alarms, surrounded by a giant wall that they can’t see over, and they have to rely on the security company to do anything about the burglar trying to get in.
I’ll take my chances with the community approach every time.