A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems.
  • niva@discuss.tchncs.deEnglish
    0·
    23 days ago

    Wow, I have 229 AUR packages installed but none of them is on the infected list!

    Am I just lucky?

    • texture@lemmy.worldEnglish
      0·
      23 days ago

      i have a few machines and lots of aur packages and none of mine have a single hit either

      • niva@discuss.tchncs.deEnglish
        0·
        21 days ago

        Same here. Just checked against the new list with 1937 packages and still don’t have a match.

      • onnekas@sopuli.xyzEnglish
        0·
        23 days ago

        How do you guys check against that list? Especially when people have so many aur packages. I simply searched the list for each package manually but I only have 5. Do you write scripts?

        • flying_sheep@lemmy.mlEnglish
          0·
          23 days ago

          So far I’ve just checked the diff of every package update. But with that many, I think we should maybe start using using the script provided in the article that you evidently didn’t read.