AURpocalypse now: a look at the recent AUR attacks
8 hours ago
- #AUR security
- #open-source vulnerabilities
- #malware attacks
- A recent sustained attack on the Arch User Repository (AUR) involved creating new accounts to adopt orphaned packages and push malicious updates, installing malware on users' systems.
- The AUR lacks formal review processes for package entries or updates, allowing registered users to adopt orphaned packages instantly, making it vulnerable to abuse.
- Unlike other distribution services like Fedora's Copr or Ubuntu's PPAs, the AUR operates under a shared namespace with relaxed ownership rules, enabling attackers to take over orphaned packages easily.
- The attack targeted hundreds of orphaned packages, using techniques like obfuscated commands in PKGBUILD files to install malicious npm or Bun packages, compromising over 1,500 packages.
- In response, AUR maintainers disabled new-user registration and are considering measures like stricter adoption processes or LLM-based detection, but long-term security challenges remain.
- Users are advised to review PKGBUILD files carefully, though in practice many treat the AUR as a standard repository, highlighting a gap between policy and real-world usage.