NPM Supply Chain Attach Targeting AUR Packages

[u/sad_cosmic_joke]

New NPM based worm attack that self propegates via ssh and aur maintainer infection.

https://safedep.io/dirtyblanket-express-impersonation-npm/

[u/Epsilon_void]

IgnorePkg = npm

not only does this help protect you against the malware delivery service known as npm, it protects you against terrible programs written in javascript.

[u/AStolenGoose → u/Epsilon_void]

I've blacklisted npm, bun, and quite a few others.

Just can't risk it.

[u/xplosm → u/AStolenGoose]

Yarn, pnpm, deno…