A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems.
how many aur packages do you have? Most people i know have like AT MOST 20 or so packages from the aur. Which takes less then 2 mins to manually check against the list.
I’m not home for a few days so I can’t check yet.
But I think I have something like 3/4 packages at the most.
But I need to compare that to a 400+ list I’m not sure I agree with you it’s that easy to do rigorously.
Not sure I understand - if you only have 3-4 packages you can just search for them specifically in the long list?
Even if you have 50 or 100s of packages, bash makes it pretty doable
comm -12 <(sort -u file1.txt) <(sort -u file2.txt) > common.txtShould spit out only the packages appearing in both lists (done by memory so may not be 100%)
Do you have anything that will wipe their butt too?
you only need to check your 3 or 4 packages to see if they were installed/updated during a certain date range.
Considering I haven’t been home since the 6th of June, I assume I probably couldn’t have been infected. But I will still do a thorough check when I get home next week.
I have much more than 20 packages in aur, most of them are dependencies from steam-native-runtime. Since steam is popular, I can understand that many have more than 20 packages.
Now when I was reading the ArchWiki I saw that it is mentioned as an alternative, so I assume I can remove steam-native-runtime and all dependencies. Perhaps the instructions have been updated or I googled for instructions and found another page. But there could be other popular packages with many dependencies.