188
Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted
(www.phoronix.com)
this post was submitted on 31 Jul 2026
188 points (98.5% liked)
Linux
66986 readers
345 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 7 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
friends don't let friends use the AUR
What's the alternative?
I only use official and flatpak, I wouldn't even use flatpak if official had more.
Chaotic aur might be worth looking into if aur is what you want. Everything there is theoretically checked.
Are you sure about chaotic? I removed it as I thought it wasn't really checked as I read in a comment here.
I'm not sure of anything, I would look into it further were I planning on using it, which I might do in the future, Garuda KDE lite looks like a decent distro.
From the little I have looked into it, it is all meant to be checked, adding an extra layer of protection, as long as your trust the people behind it (much like official I guess)
Nix on Arch maybe?
😎 Debian 😎
Not rolling release
all they have to do is to check the damn diff, if that's not easy for someone then they should stop using a computer altogether. I mean they could just click to random links on the internet right?
Literally what the AUR says to do before installing any package yet apparently no one does it.
No. It just means they should stop using AUR