250
Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware
(www.phoronix.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 12 Jun 2026
250 points (100.0% liked)
Linux
66774 readers
490 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 7 years ago
MODERATORS
i wouldnt know where to get the info in the first place. when i use windows update i also dont reed any changelog because that shouldnt be the users job but the suppliers
The whole point of the AUR is that it's just random people's code. There is no supplier here. If you don't know where to find that information, you really shouldn't be using AUR.
In an ideal world yes, but I needed some software that was only available via AUR and if the official guides tell me I can install it via AUR I will.
that is indeed the official guides' fault if they're not in charge of helping maintain the AUR package. not the case for most of the infected packages here other than notably alvr, though.
As an avid user of the AUR, you'd be correct if you were downloading from the official arch repository. But you aren't. AUR is basically like downloading from github. The only "guarantee" you get is from whoever put the package up and its up to you to determine if they're trustworthy.
windows update doesn't force you to take a look at the changelog. most AUR helpers do so you better bet that it's important