TranscriptImage of a man pointing a gun at his own foot.

Caption: Installing an AUR package without reading it's PKGBUILD.

you are viewing a single comment's thread
view the rest of the comments
[–] 25 points 2 months ago*

as the other commenter said, but worth echoing:

  • is it suddenly using npm to install/run something? (iirc this was the attack vector for most packages that were infected)
  • suddenly added some weird extra wget/curl/whatever to packaging methods to fetch something weird?
  • are the package's sources (eg. github urls) legit?

Generally you should be aware of who'se software you're installing -> check if it's downloading the stuff from right place, and nothing extra. The PKGBUILD changes in the aur website are pretty good indicator if something has changed and how.

edit: npm itself, or it's usage isn't bad - but it is quite suspicious if the AUR package isn't for some webapp or so.

  • source
  • parent