this post was submitted on 16 Jun 2026
579 points (98.0% liked)
linuxmemes
31803 readers
624 users here now
Hint: :q!
Sister communities:
Community rules (click to expand)
1. Follow the site-wide rules
- Instance-wide TOS: https://legal.lemmy.world/tos/
- Lemmy code of conduct: https://join-lemmy.org/docs/code_of_conduct.html
2. Be civil
- Understand the difference between a joke and an insult.
- Do not harrass or attack users for any reason. This includes using blanket terms, like "every user of thing".
- Don't get baited into back-and-forth insults. We are not animals.
- Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
- Bigotry will not be tolerated.
3. Post Linux-related content
- Including Unix and BSD.
- Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of
sudoin Windows. - No porn, no politics, no trolling or ragebaiting.
- Don't come looking for advice, this is not the right community.
4. No recent reposts
- Everybody uses Arch btw, can't quit Vim, <loves/tolerates/hates> systemd, and wants to interject for a moment. You can stop now.
5. π¬π§ Language/ΡΠ·ΡΠΊ/Sprache
- This is primarily an English-speaking community. π¬π§π¦πΊπΊπΈ
- Comments written in other languages are allowed.
- The substance of a post should be comprehensible for people who only speak English.
- Titles and post bodies written in other languages will be allowed, but only as long as the above rule is observed.
6. (NEW!) Regarding public figures
We all have our opinions, and certain public figures can be divisive. Keep in mind that this is a community for memes and light-hearted fun, not for airing grievances or leveling accusations. - Keep discussions polite and free of disparagement.
- We are never in possession of all of the facts. Defamatory comments will not be tolerated.
- Discussions that get too heated will be locked and offending comments removed. Β
Please report posts and comments that break these rules!
Important: never execute code or follow advice that you don't understand or can't verify, especially here. The word of the day is credibility. This is a meme community -- even the most helpful comments might just be shitposts that can damage your system. Be aware, be smart, don't remove France.
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Relatively new Linux user here.
I've seen a few posts about malware on Linux mentioning things called AUR and NPM.
I understand they are package managers? Is that something I have to worry about as a Bazzite user?
As other people have stated, you do not need to worry about the AUR issue specifically since Bazzite is not based on Arch Linux. Also, unless you are building Node based application (node being a JavaScript based runtime environment), you shouldn't have to worry about that one.
That said, these platforms are just the latest targets because they have huge enterprise user bases. Any centralized repository has the potential for vulnerability, especially ones with unvetted user submissions.
Arch is a bleeding edge distro. Basically if you hear about some new feature coming to Linux, Arch probably had for about a week already. This obviously has its downsides like stability.
The AUR (Arch User Repository) is basically a list of scripts that anyone can put together. In the scripts are various commands to download a program and how to build/install it. Where it pulls from and how it does it is completely up the uploader. Which makes it extremely dangerous.
This is not representative of the rest of Linux systems and how they function. Arch's AUR is as close to downloading random installers from a website and running it on your Windows computer you can get.
As for NPM, it's basically the same thing for JavaScript libraries, but worse.
npm: Node Package Manager.
AUR: Arch User Repository.
Bazzite is based on fedora not Arch so you don't need to worry.
Ah alright, thanks for the info!
Not likely. Just know that AUR is user driven and not checked or vetted.
Yeah, I try to stick to the native flatpak manager for bazzite. Are there any other vetted software managers out there that you would recommend?
Not really, almost any method (that is managed) is fine. Just read about where its coming from before downloading. Even user based is fine, if you trust it.
AUR is something related only to Arch Linux. Bazzite is not related to Arch, so you're good.
NPM is the Node Package Manager. Unless you're doing something like installing Node JS stuff then you don't need to worry about this. I feel fairly confident that this is one of those things where you'd know if you were using it.