Linux

14576 readers

631 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 3 years ago

MODERATORS

Ategon@programming.dev

anzo@programming.dev

dwraf_of_ignorance@programming.dev

105

Active AUR malicious packages incident (archlinux.org)

submitted 1 month ago by nemeski@mander.xyz to c/linux@programming.dev

27 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] brucethemoose@lemmy.world 10 points 1 month ago* (last edited 1 month ago) (1 children)

Also… yeah, this is a rather damning incitement against the AUR system.

It’s always been “install at your own risk,” but it doesn’t feel like the trust model is sustainable anymore.

[–] A_norny_mousse@piefed.zip 5 points 1 month ago

this is a rather damning incitement against the AUR system

It's not without good reason that Arch Linux never supported any AUR automation system beyond makepkg. You are supposed to take a good look at the PKGBUILD before you continue.

It's mostly distros that integrated AUR into their package management that are gnashing their teeth now.

That said, the list of affected packages is mind-bogglingly long and I desperately want to know more about this. Can't all be completely separate incidents.