106
Active AUR malicious packages incident (archlinux.org)
submitted 4 months ago by to c/linux@programming.dev
27 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 10 points 4 months ago* (1 child)

Also… yeah, this is a rather damning incitement against the AUR system.

It’s always been “install at your own risk,” but it doesn’t feel like the trust model is sustainable anymore.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 5 points 4 months ago

    this is a rather damning incitement against the AUR system

    It's not without good reason that Arch Linux never supported any AUR automation system beyond makepkg. You are supposed to take a good look at the PKGBUILD before you continue.

    It's mostly distros that integrated AUR into their package management that are gnashing their teeth now.

    That said, the list of affected packages is mind-bogglingly long and I desperately want to know more about this. Can't all be completely separate incidents.

  • permalink
  • fedilink
  • source
  • parent