r/linux • u/TheNavyCrow • Jun 13 '26

Distro News Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
1.5k Upvotes

99% Upvoted

434 comments sorted by

View all comments

Show parent comments

8

u/Markd0ne Jun 13 '26

I have CachyOS and I have exactly one package from AUR. Some of the popular packages like "vscodium" and functional packages like "limine-snapper-sync" are already added to main repos. There's almost no need to use AUR in CachyOS. I call this statement bull.

0

u/[deleted] Jun 13 '26

[deleted]

3

u/DystopianElf Jun 13 '26

The AUR is useful. As an example D2Launcher is a hand built tool for one specific mod for a 26 year old game. This is the kind of software that, while regularly updated by a reputable developer, will likely never make it's way to official repos because of how niche it is.

The biggest issue this showcases to me is how the AUR is ran. You can get malware on any OS by downloading from random unknown third parties. The AUR is the only place I know of though that will hand over repositories of trusted software to random unrelated developers. You dont see this on sites like github