A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems.
  • KassioAug@lemmy.dbzer0.comEnglish
    9·
    1 day ago

    I was starting to get too confident in AUR. Thankfully I wasn’t affected. Just replaced all possible AUR packages to their respective Arch and Flatpak alternatives, with exception of very few or from the ones I had no option. But will definitely check before updating them, and will only install AUR packages as a last resort.

    • HaraldvonBlauzahn@feddit.orgEnglish
      2·
      24 hours ago

      Have a look into the Guix package manager. It works fine on top of Arch, and Guix has 31,000 packages now. Great for cross-language development and also suitable for early sharing of projects. npm support is a bit weak though, but packages written in Python, Rust, or functional languages are well represented.

      • Jason2357@lemmy.caEnglish
        1·
        2 hours ago

        Thats like nix packager, right? Looks interesting to layer on top. Says they are all reproducible builds which is nice.

        • HaraldvonBlauzahn@feddit.orgEnglish
          1·
          31 minutes ago

          Yes, Guix is initially a clone of Nix and has still remains of shared code (the build daemon).

          Differences:

          • Guix packages are defined in a Scheme dialect called Guile, a nice minimal functional language
          • Guix was created as a GNU project and stresses the importance of free software with strong copyleft
          • everything is built from source
          • very good and well organized documentation