Crumpled6273 comments on Arch Linux: The AUR malicious packages incident continues to happen

Arch Linux: The AUR malicious packages incident continues to happen (www.xda-developers.com)

submitted 1 month ago by Crumpled6273@lemmy.ca [M] to c/keralalinux@lemmy.ca

7 comments fedilink hide all child comments

CachyOS provides many packages that are not available in the official Arch repo. But no matter what, I still prefer vanilla arch over anything else... What about you?

[–] Crumpled6273@lemmy.ca [S] 4 points 1 month ago* (2 children)

Debian/Arch official repos fetch software directly from the distro maintainers, while AUR packages can be uploaded by anyone. So theoretically, Debian/Arch repos are considered more secure than AUR packages. Even Flatpaks are also more secure than AUR packages.

permalink

fedilink

source

parent

hideshow 2 child comments

[–] Dadifer@lemmy.world 1 point 1 month ago (1 child)

How can previously installed AUR packages be compromised, though?

permalink

fedilink

source

parent

hideshow 1 child comment

[–] Crumpled6273@lemmy.ca [S] 4 points 1 month ago

When the upstream URL gets updated with the malicious uploaders new URL. There is no warning shown in the process; the only way to check it is to inspect the PKGBUILD manually.

permalink

fedilink

source

parent