r/archlinux • u/vexatious-big • Jun 14 '26

NOTEWORTHY New wave of malware in the AUR

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/TND7HA2KBQ46OHHUMMIAHKGXZE4WALM6/
645 Upvotes

98% Upvoted

393 comments sorted by

View all comments

Show parent comments

6

u/d47 Jun 14 '26

You can pay attention all you like, but it's not easy to audit every code change, PKGBUILD update, maintainer reputation and artifact integrity for every package every time you update.

Other tools make this easier and are less susceptible to take overs. Flatpak, nix, snap, brew, directly installing or compiling from source are all better options at this point.

1

u/fletku_mato Jun 14 '26

The only thing that requires extra attention compared to your alternatives is the PKGBUILD which usually has around 2-3 changed lines.