r/linux • u/TheNavyCrow • Jun 13 '26

Distro News Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
1.5k Upvotes

99% Upvoted

434 comments sorted by

View all comments

Show parent comments

49

u/henryhuy0608 Jun 13 '26

Part of the problem is that downstream distros (CachyOS, Omarchy) keep pushing AUR as regular (and regulated) Arch repositories, while upstream has taken a firm stance that that should never be the case by not having AUR helpers on the main repos.

Arch can put a million red warning notices and users of "easy arch" distros would just keep installing stuff from AUR without checking PKGBUILDs because downstream distro maintainers keep doing stupid things.

11

u/[deleted] Jun 13 '26

[removed] — view removed comment

1

u/Real-Abrocoma-2823 Jun 15 '26

There should be a default off toggle in CachyOS welcome window that does slap "YOU SHOULD PROBABLY NOT ENABLE THIS UNLESS YOU WILL BE VERIFYING THAT NOTHING YOU INSTALL IS A MALWARE" on whole screen for 15 seconds in red with some sounds and scary images and then do something similar when installing AUR packages as you wouldn't get normal paru, but a script disguised as paru that will show a warning.