You’re pretty much only at risk on this one if you’re doing Javascript development or running a server. The popular Javascript and Python library repos seem to get successfully attacked a couple of times a year each.
Linux main distro repos haven’t been reporting any significant breaches. You should be okay to update your system (but if you’re on Arch or one of its downstreams, maybe steer clear of AUR packages for now).
As in the official GitHub or whatever repo they’re using lists their aur package as an install message. So I’m not just downloading a potential clone/fake package with a similar name that could’ve been orphaned and taken over in the recent aur malware campaigns
tbh I do feel like it’s somewhat relevant in this case since the packages that were compromised on the AUR were due to the AUR’s package transfer ability for unmaintained packages
You’re pretty much only at risk on this one if you’re doing Javascript development or running a server. The popular Javascript and Python library repos seem to get successfully attacked a couple of times a year each.
Linux main distro repos haven’t been reporting any significant breaches. You should be okay to update your system (but if you’re on Arch or one of its downstreams, maybe steer clear of AUR packages for now).
That’s true as long as none of the apps you use as a user have the compromised packages bundled with them…
Yea I use like 2 or 3 things from aur and they’re maintained by the developer… the recent aur attacks haven’t worried me a bit
‘Bring maintained by their dev’ sounds kind of redundant. As long as you are not close with them that sounds like a bad take
As in the official GitHub or whatever repo they’re using lists their aur package as an install message. So I’m not just downloading a potential clone/fake package with a similar name that could’ve been orphaned and taken over in the recent aur malware campaigns
tbh I do feel like it’s somewhat relevant in this case since the packages that were compromised on the AUR were due to the AUR’s package transfer ability for unmaintained packages
But you still will not be notified when this changes?
Admittedly the dev maintaining the aur sounds better than random person…