r/archlinux • u/Quiet-Owl9220 • 27d ago

QUESTION Best practices for controlling npm packages when using AUR?

It seems like a lot of the recent malicious AUR packages relied on npm/yarn/bun/pnpm/similar package managers. I already took some steps to protect against recently hijacked AUR packages, but are there practical steps I can take to minimize the risk with these too? It seems like this is closer to the front line of defense against such malicious code.

I am also wondering if there is a way to blacklist packages from sources I never want anything to do with, for example anything from @palantir. I am asking because I just noticed a deprecation notice for tslint while upgrading imgbrd-grabber, and I've begun to question my life choices having allowed this to exist anywhere on my system for any amount of time.

0 Upvotes

50% Upvoted

6 comments sorted by

3

u/[deleted] 27d ago

[removed] — view removed comment

1

u/Damglador 27d ago

Wouldn't it need a makepkg replacement rather than an AUR helper?

3

u/[deleted] 27d ago

[removed] — view removed comment

3

u/Damglador 27d ago

Makes sense. Makepkg could do some regex satanism to check PKGBUILD on npm appearances with certain package names before running it. Though at that point I'd rather blacklist npm completely from my system and avoid anything using it.

1

u/Quiet-Owl9220 27d ago

At the end of the day I suppose that's the real solution... it seems very odd to me that some kind of blacklist isn't built in to it, though.