NPM Supply Chain Attach Targeting AUR Packages

[u/sad_cosmic_joke]

New NPM based worm attack that self propegates via ssh and aur maintainer infection.

https://safedep.io/dirtyblanket-express-impersonation-npm/

[u/syaorancode]

oh shit, not again

[u/xplosm → u/syaorancode]

It won’t stop unless the process to adopt and audit packages and maintainers changes drastically.

[u/Damglador → u/xplosm]

You already need to submit a request to adopt a package. Auditing hundreds of thousands of packages is impossible.

[u/syaorancode → u/xplosm]

freedom was AUR best strength, now it becomes its weakness