A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems.
  • ExLisper@lemmy.curiana.netEnglish
    42·
    24 days ago

    it’s more like a bunch of community install scripts for stuff that isn’t officially supported yet - for popularity or other reasons.

    I’m looking at the list of affected packages and many of them are in official debian repos. Isn’t the issue then that the official Arch repositories don’t have many packages and people have to use less secure sources? That still sounds like an Arch issue to me.