A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems.
    • caseyweederman@lemmy.caEnglish
      3·
      4 hours ago

      I think there was a word missing.
      To respond to what I think you were saying, this event happened in the Arch User Repository, and not the official repositories.
      Arch is very clear that they are not responsible for what goes on in the AUR. For example on https://aur.archlinux.org/ :

      DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.

      The Debian equivalent would be somewhere between extrepo and PPAs.

      • stealth_cookies@lemmy.caEnglish
        5·
        3 hours ago

        I think the comment makes sense, if more packages were supported on the main Arch repos there would be less of a need to use the AUR or Flatpaks.

        There are definitely some big gaps on the Arch repos (web browsers in particular) that I would like to see improved.

        • caseyweederman@lemmy.caEnglish
          1·
          3 hours ago

          You’re right, but web browsers can be pretty brutal to build and they are for sure never going to add -bin versions.

      • Mwa@thelemmy.clubEnglish
        2·
        3 hours ago

        maybe i went offtopic but i was comparing the AUR To Debian’s repos, i see that Debian has more packages in its repos(things like Llama-CPP and Open arena is in debian but arch needs the AUR)
        thats what i meant