![\"arch-linux\"](\"https:\/\/www.newsbeep.com\/ie\/wp-content\/uploads\/2026\/06\/arch-linux.jpg\")
Elyse Betters Picaro\/ZDNET<\/p>\n Elyse Betters Picaro\/ZDNET<\/p>\n
Follow ZDNET:\u00a0Add us as a preferred source<\/a>\u00a0on Google.<\/p>\n ZDNET’s key takeawaysThe Arch User Repository was found to contain malicious apps.Twice in a week’s span was this discovered.Users are warned to be vigilant, but there are other, easier ways.<\/p>\n Researchers at software supply chain management company Sonatype found that the Arch User Repository contained about 1,500 malicious packages<\/a>, the company said in a blog post updated June 12.<\/p>\n “We continue to encourage all users of AUR packages to review\u00a0all\u00a0PKGBUILD and install script changes when updating, especially during this time. If you notice suspicious commits to a package that you use, please reach out to Arch staff via the aur-general mailing list with more information,” The Arch team said in a\u00a0brief statement<\/a>.<\/p>\n This does not bode well for a repository that was created to dramatically increase the amount of software available to Arch (and Arch derivative) users. <\/p>\n Also:\u00a0Archcraft is a solid, super fast distro for anyone ready to move beyond beginner Linux<\/a><\/p>\n The AUR is essentially a way for developers to make new software available to users of Arch Linux before it is officially added to the Arch repositories. It’s a collection of package descriptions (named PDKGUILDs) that make it possible to compile a package from source code using the makepkg tool and then install the package via the Arch Linux package manager, pacman.<\/p>\n The thing about the AUR is that anyone can upload packages to it, and a group of Trusted Users is charged with keeping tabs on what goes in.<\/p>\n You can see where this is going, right?<\/p>\n Imagine you’re one of those volunteer Trusted Users charged with checking every app that is submitted to a repository. Now, imagine you’re a bad actor wanting to inject malware into that repository. You obfuscate the malware, submit the app as legit, and assume the Trusted Users won’t have time to dig through every line of your code. The Trusted User does a quick scan of your code and doesn’t see the obfuscation.<\/p>\n Blamo! You’ve just added a malicious app to the AUR.<\/p>\n Within the span of one week, roughly 1,500 malicious apps made their way into the repository, which means something has to change; otherwise, Arch (and Arch-based) users aren’t going to be able to trust the AUR. There have been no reports on what these malicious apps do, nor who submitted them.<\/p>\n Also:\u00a0I’ve used Linux for 30 years – 4 frustrations remain, including 2 that push me back to MacOS<\/a><\/p>\n In the meantime, I have a few recommendations for Arch users.<\/p>\n Uninstall, uninstall, uninstall<\/p>\n First, you need to uninstall anything you’ve installed from the AUR, and hope that it’s not too late. At the moment, I have no idea how bad the malicious code is that made it into the AUR, so there’s no telling the damage it could have or did do to your system(s).<\/p>\n Fortunately, to remove the package, you can use pacman like so:<\/p>\n sudo pacman -R PACKAGENAME<\/p>\n Where PACKAGENAME is the package to be removed.<\/p>\n Once you’ve done that, check to ensure the package has been removed with the command:<\/p>\n pacman -Q<\/p>\n The above command will list every package installed on your system.\u00a0<\/p>\n Stop using the AUR<\/p>\n Next, stop using the AUR, at least until the developers and Trusted Users can come up with a solution to avoid this problem. After taking care of that, consider the AUR off-limits until the developers have found a way to make it safe.<\/p>\n After you’ve removed all of the packages and stopped using the AUR, do yourself a favor and use a tool like Wireshark to test for any suspicious outgoing traffic. If you spot something you don’t recognize, look it up. If it’s unknown or known to be related to malicious code, either block the outgoing traffic or reinstall your OS.\u00a0<\/p>\n Do not take any chances.<\/p>\n Adopt a universal package manager<\/p>\n In place of the AUR, install Flatpak and install apps from there. With Flatpak, you’ll have tons of applications to install, so you won’t miss the AUR nearly as much as you think. You can install Flatpak with the command:<\/p>\n sudo pacman -S flatpak<\/p>\n After installation, add the Flathub<\/a> repository with:<\/p>\n flatpak remote-add –if-not-exists –user flathub https:\/\/dl.flathub.org\/repo\/flathub.flatpakrepo<\/a><\/p>\n You can then install anything you need, like so:<\/p>\n flatpak install PACKAGENAME<\/p>\n Where PACKAGENAME is the name of a package found on Flathub. You’ll find that there are apps on Flathub that weren’t available in the AUR (even proprietary apps like Spotify and Slack).<\/p>\n