A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems.
  • Holytimes@sh.itjust.worksEnglish
    71·
    1 day ago

    how many aur packages do you have? Most people i know have like AT MOST 20 or so packages from the aur. Which takes less then 2 mins to manually check against the list.

    • BurgerBaron@quokk.auEnglish
      1·
      4 hours ago

      I try to not use any, I have 6 and 4 of those are maintained by the developer, not some rando.

      One I really dislike is that CachyOS when you install their gaming software bundle…it uses the AUR version of Heroic Games Launcher instead of their own repo and CachyOS does not maintain the Heroic AUR AFAIK. I guess because AUR updates more frequently than their own repo? I think it’s bad practice.

    • Kjell@lemmy.worldEnglish
      1·
      6 hours ago

      I have much more than 20 packages in aur, most of them are dependencies from steam-native-runtime. Since steam is popular, I can understand that many have more than 20 packages.

      Now when I was reading the ArchWiki I saw that it is mentioned as an alternative, so I assume I can remove steam-native-runtime and all dependencies. Perhaps the instructions have been updated or I googled for instructions and found another page. But there could be other popular packages with many dependencies.

    • Tetsuo@jlai.luEnglish
      1·
      1 day ago

      I’m not home for a few days so I can’t check yet.

      But I think I have something like 3/4 packages at the most.

      But I need to compare that to a 400+ list I’m not sure I agree with you it’s that easy to do rigorously.

      • shelf@piefed.socialEnglish
        1·
        2 hours ago

        you only need to check your 3 or 4 packages to see if they were installed/updated during a certain date range.

        • Tetsuo@jlai.luEnglish
          1·
          2 hours ago

          Considering I haven’t been home since the 6th of June, I assume I probably couldn’t have been infected. But I will still do a thorough check when I get home next week.

      • hoppolito@mander.xyzEnglish
        5·
        1 day ago

        Not sure I understand - if you only have 3-4 packages you can just search for them specifically in the long list?

        Even if you have 50 or 100s of packages, bash makes it pretty doable

        comm -12 <(sort -u file1.txt) <(sort -u file2.txt) > common.txt

        Should spit out only the packages appearing in both lists (done by memory so may not be 100%)