Arch Linux: The AUR malicious packages incident continues to happen (www.xda-developers.com)

submitted 1 day ago by Crumpled6273@lemmy.ca to c/keralalinux@lemmy.ca

7 comments fedilink hide all child comments

CachyOS provides many packages that are not available in the official Arch repo. But no matter what, I still prefer vanilla arch over anything else... What about you?

you are viewing a single comment's thread
view the rest of the comments

[-] Crumpled6273@lemmy.ca 4 points 1 day ago* (last edited 1 day ago)

Debian/Arch official repos fetch software directly from the distro maintainers, while AUR packages can be uploaded by anyone. So theoretically, Debian/Arch repos are considered more secure than AUR packages. Even Flatpaks are also more secure than AUR packages.

[-] Dadifer@lemmy.world 1 points 1 day ago

How can previously installed AUR packages be compromised, though?

[-] Crumpled6273@lemmy.ca 4 points 22 hours ago

When the upstream URL gets updated with the malicious uploaders new URL. There is no warning shown in the process; the only way to check it is to inspect the PKGBUILD manually.

this post was submitted on 01 Aug 2026

9 points (100.0% liked)

Kerala Linux Community

45 readers

16 users here now

A community for Kerala Linux Users 🐧 Ask questions, share setups, and help each other.

founded 3 months ago

MODERATORS

Crumpled6273@lemmy.ca