400 AUR packages compromised, or why I stopped trusting build scripts

The Arch User Repository got hit with malware across more than 400 packages this week. The attacker did not exploit a zero-day. They uploaded malicious build scripts. PKGBUILD files run arbitrary bash during installation. Users ran makepkg without reading what they were executing. The malware ran. This is not a theoretical supply chain attack. This is the obvious consequence of a repository where anyone can upload anything and the trust model is “read the source yourself”. Most people do not read the source. I do not read the source. Nobody reads the source until something breaks. The AUR is popular because it has everything. It has everything because the barrier to entry is zero. Zero barrier means zero review. The compromise was detected because someone noticed suspicious network traffic, not because of any automated scanning. There is no automated scanning. The repository design assumes users are paranoid and vigilant. Most users are neither. I used the AUR for years. I installed packages with yay -S and trusted that someone else had vetted them. That trust was misplaced. The attack surface is the install script, and install scripts can do anything. Download a binary from a sketchy domain, modify system files, exfiltrate credentials. All of that is valid PKGBUILD behaviour if you are creative enough with bash. The fix is not better tooling. The fix is accepting that community repositories with no review process will get compromised. If you need a package that is not in the official repos, you read the PKGBUILD yourself or you accept the risk. There is no middle ground. Convenience and security are opposites here.

---

Source: Arch Linux’s AUR Sees More Than 400 Packages Compromised with Malware