428
400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers (cybersecuritynews.com)
submitted 5 months ago by to c/technology@lemmy.world
123 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 5 months ago (2 children)

it’s more like a bunch of community install scripts for stuff that isn’t officially supported yet - for popularity or other reasons.

I'm looking at the list of affected packages and many of them are in official debian repos. Isn't the issue then that the official Arch repositories don't have many packages and people have to use less secure sources? That still sounds like an Arch issue to me.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 7 points 5 months ago

    Arch actually has a large amount of official packages. Maybe some of the packages you're referring to are just slightly renamed or alternate versions?

    It's possible that in some areas it has fewer packages of course (e.g. Debian might repackage a larger subset of PyPI as Python packages), but I need the AUR for very few things.

  • permalink
  • fedilink
  • source
  • parent