this post was submitted on 12 Jun 2026
440 points (99.8% liked)

Technology

85392 readers
4088 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
440
400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers (cybersecuritynews.com)
submitted 1 day ago by rafssunny@lemmy.zip to c/technology@lemmy.world
132 comments fedilink hide all child comments
top 50 comments
sorted by: hot top controversial new old
[–] KssioAug@lemmy.dbzer0.com 8 points 6 hours ago (1 children)

I was starting to get too confident in AUR. Thankfully I wasn't affected. Just replaced all possible AUR packages to their respective Arch and Flatpak alternatives, with exception of very few or from the ones I had no option. But will definitely check before updating them, and will only install AUR packages as a last resort.

[–] HaraldvonBlauzahn@feddit.org 1 points 4 hours ago* (last edited 4 hours ago)

Have a look into the Guix package manager. It works fine on top of Arch, and Guix has 31,000 packages now. Great for cross-language development and also suitable for early sharing of projects. npm support is a bit weak though, but packages written in Python, Rust, or functional languages are well represented.

[–] Lord743@lemmy.world 12 points 11 hours ago* (last edited 11 hours ago)

1500+ now https://md.archlinux.org/s/SxbqukK6IA

[–] Cease@mander.xyz 16 points 14 hours ago (3 children)

I think a lot of people are confusing what the AUR actually IS. It is NOT the official package repository used by Archlinux - it's more like a bunch of community install scripts for stuff that isn't officially supported yet - for popularity or other reasons.

So for all those people complaining and saying "debian does it better" it's very likely that you would not even HAVE a package to install and would have to come up with a build script on your own - the AUR allows you to skip this and instead just verify that the script itself isn't malicious, which is usually fairly obvious.

A lot of people here seem to be under the impression that all of this effort should be abstracted for them - but that's what you chose when you left windows - a system that you control intimately with a necessitation to actually do some upkeep yourself because a giant company isn't doing it for you.

In other words. RTFM and stop expecting other people fix all your problems for you, because that's exactly how windows got to how it currently is.

[–] Jjakef96@lemmy.world 2 points 4 hours ago (2 children)

I haven't been on my PC that much this week, just Friday night. And our D&D group uses Discord so I needed to make sure it was up to date to ensure it would run. I typically just do a, "sudo pacman -Syu" and that seems to update what I need.

If that is the only thing I did with the PC during this window, is there any concern?

[–] Lord743@lemmy.world 2 points 4 hours ago* (last edited 3 hours ago)

Nah, you're fine the Discord package(https://archlinux.org/packages/extra/x86_64/discord/) is in the official repo and it was not affected at all. The only people who should worry are those using AUR helpers to install packages without checking the PKGBUILD

[–] flop_leash_973@lemmy.world 2 points 4 hours ago* (last edited 4 hours ago)

Probably not. The article says that most of it seems to have come from orphaned stuff in the AUR that the threat actors took ownership of via the legit process, then modified to pull down malicious NPM packages when someone went to install them.

So if your Discord package is well maintained you probably have nothing to worry about.

[–] ExLisper@lemmy.curiana.net 6 points 11 hours ago (3 children)

it’s more like a bunch of community install scripts for stuff that isn’t officially supported yet - for popularity or other reasons.

I'm looking at the list of affected packages and many of them are in official debian repos. Isn't the issue then that the official Arch repositories don't have many packages and people have to use less secure sources? That still sounds like an Arch issue to me.

[–] HaraldvonBlauzahn@feddit.org 2 points 7 hours ago* (last edited 5 hours ago)

Isn’t the issue then that the official Arch repositories don’t have many packages .....?

Not at all. The official Arch distribution has tens of thousands of packages and the user repository / AUR probably more than 100,000 .

Edit: I looked it up:

  • According to distrowatch.com, the Arch Linux distribution has over 17,000 packges by now
  • Meanwhile, the number of packages in the Arch User Repository is 114,000 .
[–] flying_sheep@lemmy.ml 7 points 11 hours ago* (last edited 11 hours ago)

Arch actually has a large amount of official packages. Maybe some of the packages you're referring to are just slightly renamed or alternate versions?

It's possible that in some areas it has fewer packages of course (e.g. Debian might repackage a larger subset of PyPI as Python packages), but I need the AUR for very few things.

[–] bhamlin@lemmy.world 2 points 8 hours ago

Just because there is an official package doesn't mean someone can't make an aur one with the same name, or with common misspelling.

load more comments (1 replies)
[–] Kazel@lemmy.dbzer0.com 3 points 11 hours ago* (last edited 11 hours ago)

Look how every motherfucker complains about arch and the aur but not that their distros blindly use it without contributing back and even suggest to blindly trust it. these same people now complain the aur is to complicated. Never go full retard guys

load more comments
view more: next ›