The AUR just got mugged in broad daylight, and half the room is still acting like the guy with the knife was only there for software engineering reasons.

Here’s the ugly little truth people keep sanding down until it looks “reasonable”: the Arch User Repository is not a curated package archive. It is a user-run trust shortcut. A convenience layer. A giant neon sign that says, please execute this stranger’s build script because it seems useful and I am tired. That’s fine until someone notices the sign.

This week’s mess is stupid in the most modern way possible. Attackers grabbed control of orphaned AUR package definitions, slipped in install-time hooks, and used those hooks to fetch malicious JavaScript baggage like atomic-lockfile or js-digest. Sonatype says the first wave was bad enough; then a second wave showed up with Bun in the mix, because apparently malware authors also enjoy ecosystem tourism.

The part that should make your teeth itch is not even the payload. It’s the shape of the lie.

The malicious code wasn’t sitting in the original source tree waving a red flag. It was tucked into package maintenance flow: PKGBUILD, post_install, lifecycle hooks, all the little places where maintainers and helpers normally do boring work and nobody expects a knife fight. The package can still look like the thing you wanted. The name is right. The repo history is familiar. The old maintainer vanished, someone “adopted” it, and now your system is merrily running a foreign install script because the social layer said this was normal.

That’s not supply chain security. That’s inheritance fraud.

And yes, the payloads sound gross because they are gross. Sonatype’s write-up on atomic-lockfile describes Linux binaries with eBPF trickery, process hiding, debugger resistance, and credential-harvesting vibes all over the place. In other words: not a harmless oopsie, not some cowboy script that forgot a semicolon, but a proper little parasite built to move quietly and leave the room with your tokens in its pockets.

What makes this especially vile is how little effort it took to smuggle in the problem. A package that usually has no reason to touch npm suddenly grows a npm install ... line in its install step, and now you’re supposed to believe that’s just maintenance. Sure. And my landlord is “just maintaining” my rent by setting it on fire.

The AUR was always a trust trade. That was the deal. You get access to a huge ecosystem of community packaging, but the price is that you are the last line of defense. Not the helper. Not the pretty GUI. Not the “it built successfully” checkmark. You. If you never inspect the PKGBUILD, you are not installing a package so much as importing somebody else’s opinion and hoping it isn’t cursed.

And no, building in a chroot doesn’t magically save you here. The ugly bit in this incident runs at install time, not build time. So congratulations: you can build the trap in a nice clean room and still get stabbed when the package lands on the actual machine.

What should you do with that information? The boring answer, unfortunately, is the right one:

  • treat AUR packages like code you are about to execute, because that is literally what they are
  • read diffs on orphaned packages like your login depends on it, because it does
  • distrust any package that suddenly introduces npm, bun, curl, or wget for no sane reason
  • watch aur-general when there’s active abuse, because the cleanup thread moves faster than your memory does
  • if you maintain AUR packages, make the install path painfully boring

If you want a quick smell test before installing something, this sort of thing is a decent start:

grep -nE 'post_install|npm|bun|curl|wget|python -c|bash -c' PKGBUILD *.install

That won’t make you safe. It will just make you less easy to scam.

The larger problem is that AUR users keep pretending the repository is “almost official,” which is how people end up surprised when an orphaned package gets adopted by a fake maintainer and quietly turned into a distribution channel for garbage. The AUR is not a government ministry. It is a communal workshop with the door left open. Sometimes that produces beautiful tools. Sometimes it produces a malware wave and a mailing list thread full of exhausted volunteers trying to put the horse back in the barn while three more horses show up wearing fake mustaches.

So yeah: the AUR is useful. It is also a trust laundromat with a very nice UI. If you want the convenience, you inherit the risk. If you want safety, install fewer things and read more diffs. Painful, I know. Reality remains an asshole.