August 2026 - Aur-general - lists.archlinux.org

dewlock v0.1.0
by Manuel Spagnolo 01 Sep '26

01 Sep '26

Hey all, Recently, I worked on some Wayland tools built around customizability, minimalism, and sensible defaults. I have been daily driving them for a while, and I am slowly releasing them. The first one is dewlock (https://github.com/shikaan/dewlock) a swaylock fork providing an experience closer to GNOME's, MacOS, and Windows along with a bunch of fixes that came from compiling it with stricter flags. I don't have an AUR account and registrations are (rightfully!) stopped, but I would like to distribute it on AUR anyway. Is there a way? Thanks,

6 9

Aur spec
by WebDawg 01 Sep '26

01 Sep '26

Hello, I was just reading a post here about how git history is sanitized. Is there an overall spec that I could read to understand everything about the aur and everything that surrounds it. I would assume that this would probably be in some type of package maintenance documentation.

3 2

Packages which ship pre-compiled binaries
by Sid Karunaratne 31 Aug '26

31 Aug '26

These 4 AUR packages ship pre-compiled binaries: - faiss-echo-git - savant-git — Not only hosts binaries, also the upstream source code - in-editor - remoteit — Has no remote `source`, everything is in-repo To be clear: I do not suspect any of them are malicious. I've left comments on all the packages requesting that they compile upstream code, but none of them have acted on the comments. Not a surprise as some of them have not had updates in ~10 years. I have not tested if the packages build, or have other issues. Should these packages be deleted? Sid

1 0

Deleted AUR packages are still available
by Дневник UNIX'оида 30 Aug '26

30 Aug '26

Hello! I've just tried to access deleted AUR repos and found out that they're still available and can be cloned. Therefore, the packages containing malware are still dangerous for users. https://aur.archlinux.org/cgit/aur.git/tree/?h=<PACKAGE_NAME> This link can be used to access them. Is it a bug or a feature?

2 1

Malicious package - hyprland-fixes
by Saren 29 Aug '26

29 Aug '26

This package contains a real config of hyprland but it blatantly opens up a backdoor for the attacker: 1. lures user to type sudo password in post-install, and then do following 2-5 without user's permissions 2. installs Tailscale and OpenSSH (--noconfirm), then joins the attacker's Tailscale network (--ssh) to bypass firewalls and grant remote shell access 3. adds an attacker ed25519 key to three locations and spawns two root sshd instances on ports 3333/4444. Uses fake Arch systemd service names to disguise config files in /etc/pacman.d/ 4. installs SUID-root binaries to three paths (/etc, /usr/lib, /usr/bin), triggered hourly by an un-stoppable systemd timer. Grants wheel users passwordless sudo execution 5. configures UFW to allow SSH ports and Tailscale IP 100.70.123.108. Wipes systemd logs (journalctl --vacuum-time=1s), disables shell history, and clears /root and user .bash_history Package URL: https://aur.archlinux.org/packages/hyprland-fixes Package source repo: https://github.com/iusearch-hyprlandbtw/hyprland-fixes Source repo snapshot: https://drop.wtako.net/file/22927ab5f074e4fafe959de72bb55db7768e1654.zip (password: "backdoor" [8 characters]

11 19

Possibly malicious package - gentor
by Andreas Reichel 29 Aug '26

29 Aug '26

All, gentor's package() runs sudo ./setup, executing a downloaded closed- source binary as root outside fakeroot. Nothing is installed into $pkgdir. The binary cannot be reviewed. The shipped artifact is v0.2 while pkgver=0.3.gentor This does not look right to me. It is the same structural defect as hyprland-fixes: sudo in a build script to escape the packaging sandbox. Best and cheers Andreas

3 4

made a new package -- existing package broken -- zork1
by Jochums Johannes 27 Aug '26

27 Aug '26

Hi everyone, I just spent my evening creating my first package, because the package in the AUR is broken, this more for the love of the game and trying something new. Then I noticed AUR registrations are currently closed. I'm more looking for some feedback, tips and suggestions https://github.com/infernoid/zork1-r88 Thank you

4 3

Proposal: Mail AUR pkgowners when their pkg got updated
by Oskar Roesler 25 Aug '26

25 Aug '26

Hello, since the new malware tried to infiltrate other AUR packages maintained by the user of the infected system, wouldn't it be a relatively low-effort countermeasure to send out a mail to the maintainers if their pkg got updated? Especially if attacks get more sophisticated, users might not notice it quickly enough. Regards, Oskar

7 8

Malicious package update - xsnow and xsnow-bin
by Saren 25 Aug '26

25 Aug '26

It downloads a lil executable called "systemmanager" from tor. I did not need to analyze the binary or script to know this is malicious. https://aur.archlinux.org/cgit/aur.git/tree/.xsnow.install?h=xsnow https://aur.archlinux.org/cgit/aur.git/tree/.xsnow-bin.install?h=xsnow-bin

6 9

Process Architecture of AUR and Trusted Users
by WebDawg 21 Aug '26

21 Aug '26

Hello, I have used the AUR extensively for the past 15 years and I would like to help. I know there have been many attacks on the AUR recently, and a lot of folks shout "check your PKGBUILD", but I think there is something more here. There are often really needed and great packages in the AUR, and I do not think we should take that for granted. I think the AUR is a big reason people use Archlinux. I want to help. Where is this discussion at, and is there anything I can do to start? I think the security of the AUR could be improved.

3 2