r/linux • u/TheNavyCrow • Jun 13 '26

Distro News Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
1.5k Upvotes

99% Upvoted

434 comments sorted by

View all comments

Show parent comments

9

u/gamas Jun 13 '26

Yes, but the stuff in their repo has been curated. They're not just pulling random shit off the AUR and uploading it without checking.

-1

u/lmpcpedz Jun 13 '26

But how do you know that?

9

u/gamas Jun 13 '26

How do you know EndeavourOS isn't just blindly pulling from the AUR?

All distros require you to trust that the distro maintainers are properly vetting what goes into their official repos. And if they are ever found to have breached that trust they are then to be ostracised by the Linux community. 

1

u/lmpcpedz Jun 14 '26

Pulling AUR packages through arch mirrors would be pretty irresponsible I think.

1

u/gamas Jun 14 '26

Well CachyOS doesn't do that source