428
400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers (cybersecuritynews.com)
submitted 4 months ago by to c/technology@lemmy.world
123 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 4 months ago (4 children)

So what would the alternative be? If the resources or desire don't exist to make a package official, how else would you install it?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] -1 points 4 months ago (3 children)

    You're missing the point entirely. I'm talking about inspecting the scripts not about making packages

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 12 points 4 months ago (2 children)

    Sorry if I was unclear. You usually don't inspect the install scripts for official packages since you put the trust in the official team. You don't trust(or at least shouldn't) AUR packages, hence you should inspect the install script for those packages. I don't really see what the alternative would be.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •