Re: [PLUG] Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

["K.S. Bhaskar via plug" <plug@lists.phillylinux.org>]

Run:

for pkg in $(yay -Qmq); do grep -E "(installed|upgraded) $pkg " /var/log/pacman.log | tail -1; done | sort

and check the output against the list at https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/

Regards

- Bhaskar

On Mon, Jun 15, 2026 at 2:48 PM Will via plug <plug@lists.phillylinux.org> wrote:

Most of the packages impacted are node.js based it seems. So... there are a group of users that aren't using packages like that from the start. I checked mine and I seem to be ok. 

Everything Rich Mingin posted is absolutely correct. 

-Will C

On Mon, Jun 15, 2026 at 2:44 PM Martin Cracauer via plug <plug@lists.phillylinux.org> wrote:

jeffv via plug wrote on Mon, Jun 15, 2026 at 01:50:45PM -0400:
> Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF
> Rootkit

More like 1700 by now.

The big question is - how many packages from AUR do you need? How many
packages that you want are in the primary repository?

Looking over the list:
https://md.archlinux.org/s/SxbqukK6IA

I offhand don't see things that I would install and find in Debian or
in FreeBSD ports but not in Arch primary.

The concept of filling package maintainers for abandoned packages from
the general population is an interesting one for sure.

Martin
--
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Martin Cracauer <cracauer@cons.org>   http://www.cons.org/cracauer/
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug