428
400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers (cybersecuritynews.com)
submitted 5 months ago by to c/technology@lemmy.world
123 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 39 points 5 months ago (2 children)

Been saying for years that people need to stop treating the AUR like a repo, when it's more akin to curl installscript.sh | bash.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 6 points 5 months ago (1 child)

    But it is a repo. It's just an unofficial one. I don't know how you use it without understanding this. It's not far from perfect, but it is useful.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 5 months ago

    the problem is exactly the fact that it is a repo; it introduces a layer of unknown between the dev and the user. and the user will unavoidably "trust" it (especially when it's listed amongst official repos in e.g. the graphical version of Pamac), without understanding the risks.

  • permalink
  • fedilink
  • source
  • parent