449
400+ Arch Linux AUR Packages Compromised in a Supply Chain Attack Deploying Infostealers (cybersecuritynews.com)
submitted 1 month ago by to c/technology@lemmy.world
144 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 1 month ago (3 children)

how many aur packages do you have? Most people i know have like AT MOST 20 or so packages from the aur. Which takes less then 2 mins to manually check against the list.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 2 points 1 month ago

    I try to not use any, I have 6 and 4 of those are maintained by the developer, not some rando.

    One I really dislike is that CachyOS when you install their gaming software bundle...it uses the AUR version of Heroic Games Launcher instead of their own repo and CachyOS does not maintain the Heroic AUR AFAIK. I guess because AUR updates more frequently than their own repo? I think it's bad practice.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 1 month ago (2 children)

    I'm not home for a few days so I can't check yet.

    But I think I have something like 3/4 packages at the most.

    But I need to compare that to a 400+ list I'm not sure I agree with you it's that easy to do rigorously.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 5 points 1 month ago (1 child)

    Not sure I understand - if you only have 3-4 packages you can just search for them specifically in the long list?

    Even if you have 50 or 100s of packages, bash makes it pretty doable

    comm -12 <(sort -u file1.txt) <(sort -u file2.txt) > common.txt

    Should spit out only the packages appearing in both lists (done by memory so may not be 100%)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 month ago

    I have much more than 20 packages in aur, most of them are dependencies from steam-native-runtime. Since steam is popular, I can understand that many have more than 20 packages.

    Now when I was reading the ArchWiki I saw that it is mentioned as an alternative, so I assume I can remove steam-native-runtime and all dependencies. Perhaps the instructions have been updated or I googled for instructions and found another page. But there could be other popular packages with many dependencies.

  • permalink
  • fedilink
  • source
  • parent