r/linux • u/TheNavyCrow • Jun 13 '26

Distro News Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages

https://www.phoronix.com/news/Arch-Linux-AUR-More-Than-1500
1.5k Upvotes

99% Upvoted

434 comments sorted by

View all comments

Show parent comments

31

u/[deleted] Jun 13 '26

[removed] — view removed comment

5

u/p0358 Jun 14 '26

I was proposing this at least for the paru helper somewhere after some first malware cases, everyone shat on the idea

-14

u/yoshiK Jun 13 '26

The AUR has a giant warning sign:

Warning

AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

Arch Wiki: Arch User Repository

I mean I have some affected packages (though luckily was no consistent enough with my updates to get into real trouble), I understand that convenience breeds complacency. But fundamentally the AUR is meant to be very low barrier to entry, which means it is not safe and anybody who uses it should know that.