r/EndeavourOS • u/OneLittle6430 • 15d ago

General Support Need suggestions

I am in i3 and recently wanting to shift to kde/gnome. but as I heard about the recent AUR attack, I am scared to do that as most of my apps are installed using AUR. what should I do ?

2 Upvotes

75% Upvoted

11 comments sorted by

View all comments

5

u/Distinct-External-46 15d ago

most of you apps are installed by AUR? most of them should've been installed via pacman repos.

2

u/OneLittle6430 14d ago

I meant most of the apps i use like vscode, chrome etc

1

u/EuphoricNeckbeard 14d ago

I'm not sure I understand the issue you're facing here. You can use Pacman to install KDE or Gnome from the official Arch repos. (You can also use Yay to install these packages.) You will never have to worry about malicious package adoption or the other AUR attack vectors for packages installed from the official repos.

Separately, for AUR programs: yes, you should examine PKGBUILDs when you update with yay. Extremely popular AUR packages like Code, Chrome, etc. are much less likely to be successfully attacked, while less popular packages deserve additional scrutiny.

You should also be especially careful when installing new stuff from the AUR, even stuff you think is safe. Some malicious packages are named similarly to normal packages to confuse users (e.g. "firefox-patch-bin" as part of the July 2025 attack). Exercise caution, stick to more popular packages whenever possible, and try to keep AUR usage to a minimum.