You can remove these manually or if using an aur helper like yay there are flags/settings you can use to delete them after the desired package was installed.
However what I was talking about aur packages that are unmaintained or do not have a maintainer anymore.
I guess the same could be said for literally any open source or freely distributed project.
The difference is that this was a supply chain attack and, to my knowledge, required the package to be listed as orphaned unmaintained first so that the PKGBUILD could be modified to install malicious NPM packages.
The community caught it quickly because it is possible to read both the PKGBUILD and the output of the update and, I think, it is fully resolved as of now.
Basically, if one were to delete or replace orphaned packages then they wouldn’t have been infected.
It is also possible to add a CVE scanner for AUR packages if reading the PKGBUILD is too much, I’m looking into how to do that now.
All this is to say that you should check if you had an infected package but I personally don’t think using the aur is more risky than using a flatpak.
I avoid
orphanedunmaintained packages and I wait a few days before I typeyayIs there a flag to prevent orphaned packages from installing?
Good question, I guess I might be using the wrong word when i say “orphan” because I see the arch wiki uses that term differently
You can remove these manually or if using an aur helper like yay there are flags/settings you can use to delete them after the desired package was installed.
However what I was talking about aur packages that are unmaintained or do not have a maintainer anymore.
I’m researching more at the moment.
shit, I had 150 orphaned packages
pacman -Qdtq | pacman -Rns -I made an alias for this, but IMO this cleanup should be automatic. The user didn’t install it themselves after all.
I don’t trust that everything that outputs from
pacman -Qdtqshould be deleted. Like I want to keepvlc.This can be prevented by uninstalling with -Rs
Just removing them without user intervention could cause unexpected behavior.
deleted by creator
You’re no fun
They also wait until they get off the rollercoaster and back on solid ground before yelling
yay!Waiting for updating doesn’t make any difference. The packages could be infected at any point.
I guess the same could be said for literally any open source or freely distributed project.
The difference is that this was a supply chain attack and, to my knowledge, required the package to be listed as
orphanedunmaintained first so that the PKGBUILD could be modified to install malicious NPM packages.The community caught it quickly because it is possible to read both the PKGBUILD and the output of the update and, I think, it is fully resolved as of now.
Basically, if one were to delete or replace orphaned packages then they wouldn’t have been infected.
It is also possible to add a CVE scanner for AUR packages if reading the PKGBUILD is too much, I’m looking into how to do that now.
All this is to say that you should check if you had an infected package but I personally don’t think using the aur is more risky than using a flatpak.
Are linux users allowed to juat lie like that? I thought if you do that you need to use Windows.
What?
C’mon, man, at least pour one out for the homies who waited to update and landed in the period where it was live and undisclosed.