428
400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers (cybersecuritynews.com)
submitted 5 months ago by to c/technology@lemmy.world
123 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 5 months ago (2 children)

I haven't been on my PC that much this week, just Friday night. And our D&D group uses Discord so I needed to make sure it was up to date to ensure it would run. I typically just do a, "sudo pacman -Syu" and that seems to update what I need.

If that is the only thing I did with the PC during this window, is there any concern?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 5 months ago*

    Probably not. The article says that most of it seems to have come from orphaned stuff in the AUR that the threat actors took ownership of via the legit process, then modified to pull down malicious NPM packages when someone went to install them.

    So if your Discord package is well maintained you probably have nothing to worry about.

  • permalink
  • fedilink
  • source
  • parent