TranscriptImage of a man pointing a gun at his own foot.

Caption: Installing an AUR package without reading it's PKGBUILD.

you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 2 months ago

The compromised packages load a script from thr net that runs a compromised npm package ("atomic-lockfile" 1.4.2).

Ok, also a AUR issue. But more so a NPM one, since they have all full moon two supply-chain attacks.

  • source
  • parent