AUR Packages Compromised with Infostealer and Rootkit

AUR doesn't guarantee security, its upto the user to use AUR & verify before installing anything, its very evident why arch is not used in enterprise solutions.

I haven't used Arch for a few years now, but when I did the AUR was my favourite aspect.

It was never perfect from a security PoV, but in 2026 this kind of trust model feels increasingly scary.

Here's an easy script to scan for compromised packages:

https://cscs.pastes.sh/aurvulntest20260611.sh

Not my script. It's easy to read/parse. Never pipe a script directly to bash.

More news is coming out about this:

https://www.phoronix.com/news/Arch-Linux-AUR-400-Compromised

I toyed with the idea that someone should write a binary that simply emails, or alert you when it's been run... as a canary... and call that `npm`.

At this point, not renaming the npm binary is a big risk.

third time this has happened:

https://news.ycombinator.com/item?id=17501379 https://news.ycombinator.com/item?id=44607740

Be aware of false positives! I found I had two of these packages installed, clang19 and compiler-rt19, but due to my recent laziness in updating my system, mine were still the versions from July 2025 from the official repos before they had relegated them to AUR.

You can check the build and install date with `pacman -Qi <package>`.

I run Arch Linux in a container (within Fedora Silverblue), but my plan for the future:

- consider switching away from Arch Linux for my dev container, with great sadness. A rolling distro is a terrible idea in the current security climate. I loved using Arch for my dev container exactly because of AUR.

- switch to Fedora Stable, perhaps the previous release which still gets security fixes but no other updates. I am still on Fedora 43, I guess I have no rush to update to 44. - be even lazier in updating my workstation. I used to update daily when I was running Arch, then I moved to weekly last year when I got stuck with slow internet, now consider updating monthly or more (of course, unless there are critical security bugs)

- Flatpak and Flathub terrify me, it's only a matter of time until malware appears. I have had automatic upgrades disabled for a while.

- for the love of God don't touch anything that uses npm

Previously: https://news.ycombinator.com/item?id=48458931

This is especially gnarly as more people have been picking up arch distros as of late (like CachyOS).

Man, I never hear good security things about npm