It depends. There are trusted well known packages and those can be trusted in my opinion. But I wouldn't install any random package someone made.

And how would moving the packages into official repo solve anything? The reason it's in the AUR is because the arch maintainers don't have time to maintain packages.

paru shows you the PKGBUILD diffs on upgrade, so you can review then and deny upgrades.

But realistically I am not going to go into the code itself on my installed packages to check for malware or other types of attacks. That's too time consuming for my risk level, and requires more knowledge than can be expected, to be honest.

Edit: but maybe you're talking about when first installing a package? Come to think of it, I'm not sure it shows the PKGBUILD at that point. 🤔

I'm just a web guy whose tired of installing 10 xetabytes of 2 line libraries every time I wanna check out anything web related

Sweats in “linux vr is one of my current hobby projects”

I panicked a bit when I saw the news earlier today as one of those niche guys. Then remembered I had removed it for WiVRn a few weeks ago and don't have anything else off the AUR. Double niche win lol

EDIT: No, sorry, alvr was just one package, there is no specific source for the infection just one or many malicious users: https://gr.ht/aur_pkg_list.txt

I'm not real clear on if this is the case but you could try:

1. Have you installed or updated from the AUR before, such as with Yay? Specifically after June 5th? If so, check this list or the post above for a list of compromised packages. https://gr.ht/aur_pkg_list.txt

2. Maybe pacman -Q | grep atomic-lockfile because that appears to be what the threat actor is installing but I'm not really sure if that's how it works...?

EDIT: If you really want to play it safe then you could try yay -R $(pacman -Qmq) to remove every aur package and wait out the storm, just be careful to backup important files.

Very useful, thanks.

Came up clear, fortunately.

Out of curiosity, did Arch send any notifications through pacman or anything? The first I heard of this was on Lemmy.

Not the one you asked, but it's a case of priorities:

• If you want it to just work, then the AUR is probably the better pick. Don't get me wrong, through; most flatpaks should (mostly) work like how you'd expect them to behave natively.
• But, (Op)Sec-wise, the verified flatpaks win. No contest. Simply, because there's no third party involved in the process. (And I haven't even gone over flatpaks' superior sandboxing.)

Minimizing AUR usage doesn't necessarily mean not using it at all, but I would weigh those advantages carefully against the risk it brings. I would also recommend the people who don't know what they are doing to not use it at all.

I am quite confused by your assumptions. I am just making a joke about people trying to avoid surveillance capitalism tools on one side and gleefully installing aur packages from random people on the other side, potentially making their surveillance exposure worse. I'm part of them some time because it's too hard to verify everything everytime.

i can empathize with those infected but it's important to note that the source of this issue is still installing random stuff from random people. the aur is not the same as arch repos, and users wanting to opt in need to take more precautions than usual

That's probably simply a more skeptical take of my own newbie perspective: the automated update systems on Linux are feeling increasingly scary since their maintainers can get hacked... I'm on Mint and I wish that the Update Manager would show changelogs per update, at least (even if those, too, can be fabricated)...