Greetings, I’m on the AUR mailing list and there has been huge influx of packages that were maliciously taken over today. Please check the PKGBUILD and be wary especially of new npm depencencies, particularly one named “atomic-lockfile”, but there might be others.

[image] Dinomonster: . My gripe was mostly about the fact that Arch has link to AUR in their front page, but don’t have any info about current issues with AUR. Archlinux is a DIY distro. It provides you with the building blocks and the freedom of choice how you use them to build YOUR system. …

While I agree with the fact that using the AUR could not always be safe , the question I have should you offer the users of e.g. “older” Nvidia hardware packages coming from the AUR or just say , that support has stopped for this hardware because there is no possibillity to use the “official” repos…

Educating themselves requires information. If information is located in the basement of the council buildin, behind locked door and there’s no directions to it, then it’s hard to learn otherwise than the hard way. Once again, I’m simply pointing out that the information should be known is not avail…

[image] Dinomonster: Educating themselves requires information. If information is located in the basement of the council buildin, behind locked door and there’s no directions to it, then it’s hard to learn otherwise than the hard way. Here is the direction to the basement: ArchWiki And here …

Once again, I’m talking about informing people about malicious packages. This doesn’t answer to it. I have been all the way talking about informing users about flood of malicious packages into AUR. It could be a single paragraph. I think we are talking about two different trees.

[image] cactux: And here is the direction to where you could turn to for airing your grievance and proposing some constructive suggestions for betterment: Arch Linux Forums To any EndeavourOS user who is thinking of doing this - don’t. The Arch forums are for Arch users, not for users of Arch…

I thought the user was complaining about why Archlinux doesn’t inform the AUR users about malicious PKGBUILDs on the front page of their site and not seeking support for a particular issue the may have with their Arch-based distro. For the former, we cannot do much about here other than wasting a l…

At this point I’m considering maybe looking for a distribution where most of the packages I use are in the default repos. Or I might just switch to Flatpak for some of them except for the ones I can’t live without.

[image] Canoe: To be very clear, even reading pkgbuilds will not protect you if there has been a concerted effort to conceal the package within a sub component or post build event. On the other hand, if you simply enable diffs in your AUR helper, all these attacks would stand out in a fairly …

after this I will enable diffs in yay, but even with that you have to be meticulous, because they can be shady in a 6 line diff too, for example changing the domain to something similar or the rest of the link that will get a bad file from a server. I wish there would be a helper for this helpers t…

Malicious AUR packages

General system Newbie

Stagger_Lee June 12, 2026, 10:29am 60

To any EndeavourOS user who is thinking of doing this - don’t. The Arch forums are for Arch users, not for users of Arch-based distros.