31
Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted (www.phoronix.com)
submitted 3 months ago by to c/archlinux@lemmy.ml
5 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 3 months ago (2 children)

I wonder why Aur is a target.

You think it's Microsoft related?

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 12 points 3 months ago (1 child)

    Probably because it's an attack vector where the effort required to infiltrate malware is relatively low.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 3 months ago* (last edited 3 months ago)

    From the mailing list thread:

    For the record, those are all new packages (not orphaned packages being adopted). I assume more will come, we'll clean those as soon as possible.

    In the mean time stay vigilant, probably refrain from installing freshly pushed new packages from the AUR for now.

    Looking over the list it's almost all git/bin versions of files. So they just added a ton of new packages like hexchat-bin that didn't have those versions before and injected malware.

  • permalink
  • fedilink
  • source
  • parent