Would using traur have prevented this attack?

https://github.com/Sohimaster/traur

third time this has happened:

https://news.ycombinator.com/item?id=17501379 https://news.ycombinator.com/item?id=44607740

More news is coming out about this:

https://www.phoronix.com/news/Arch-Linux-AUR-400-Compromised

I toyed with the idea that someone should write a binary that simply emails, or alert you when it's been run... as a canary... and call that `npm`.

At this point, not renaming the npm binary is a big risk.

This is one of the aspects of AUR which never fully convinced me: it purely hosts user-generated content, there's no review process or alike.

I'd really prefer to see a model where a 'community' repository contains user submitted packages which have at least one Trusted User review the package before it's merged in. This doesn't just prevent malware, but also common mistakes in general.

Lots of discussions now, from different source articles:

https://hn.algolia.com/?dateRange=last24h&page=0&prefix=fals...

I haven't used Arch for a few years now, but when I did the AUR was my favourite aspect.

It was never perfect from a security PoV, but in 2026 this kind of trust model feels increasingly scary.

Here's a commit showing how they did it: https://aur.archlinux.org/cgit/aur.git/commit/?h=pass-cli&id...

Internet archive URL: https://web.archive.org/web/20260611213640/https://aur.archl...

There are some AUR hooks that can help. I use https://github.com/Sohimaster/traur which also has scans for orphan package takeover patterns.

This is especially gnarly as more people have been picking up arch distros as of late (like CachyOS).

Not the first time this has happened recently. There were a few emails in the AUR list a few weeks ago about malicious packages, and a few reports on IRC too. The only difference in the campaign back then was the malicious npm package name (`linux-utils` in the campaign a few weeks ago).