this post was submitted on 12 Jun 2026
227 points (100.0% liked)
Linux
65827 readers
1017 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 7 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
(hopefully this doesn't read as blaming the victims instead of the attackers but) I personally don't think it's that complicated to read the updates to AUR packages. It's not any more hard than only commenting after reading the links that people post here instead of just the headlines—which we all do, right?
I don't think it's immediately obvious that the PKGBUILD installing some shit with npm is malware.
it's bypassing the normal place to download (in the PKGBUILD) and doing so in a place that's unsandboxed instead (in the .install file, not the PKGBUILD) when it didn't need to do that before
i wouldnt know where to get the info in the first place. when i use windows update i also dont reed any changelog because that shouldnt be the users job but the suppliers
The whole point of the AUR is that it's just random people's code. There is no supplier here. If you don't know where to find that information, you really shouldn't be using AUR.
In an ideal world yes, but I needed some software that was only available via AUR and if the official guides tell me I can install it via AUR I will.
that is indeed the official guides' fault if they're not in charge of helping maintain the AUR package. not the case for most of the infected packages here other than notably alvr, though.
As an avid user of the AUR, you'd be correct if you were downloading from the official arch repository. But you aren't. AUR is basically like downloading from github. The only "guarantee" you get is from whoever put the package up and its up to you to determine if they're trustworthy.
windows update doesn't force you to take a look at the changelog. most AUR helpers do so you better bet that it's important