Arch Linux’s AUR Compromised with Malware (over 1,500 packages!)

The video below is a good review, and if you use the AUR, you should always check the packages. Worth pointing out, some of these pkgbuild scripts convert Debian binary packages while some build from source, packaging the software so it’s compatible with Pacman and Yay for easy removal and updating later. And there is usually a choice to install the converted official binary or build from source, with the converted binary being much quicker and easier.

If you click on the graphic above it will take you to the AUR page where you can click and see the updates to the pkgbuild script (bottom), and I like to look at the details and check the comments to see how robust the community is around the package, as well as looking for any red flags for using the package. And worth noting, reputation is very important in the Linux community, and people that put up AUR packages are respectable people actually scratching their own itch in making the package available on Arch, because they use it and want an easier way to manage it. Of course now, we’ll need to check the pkgbuild scripts diligently, as anyone’s credentials can be stolen.

And one last thing, I use Endeavor OS, basically vanilla Arch with easy installation and some added tools and scripts, handy for maintanance, but it’s extremely stable for me (it’s on three computers here). It’s helpful if you know your way around Linux to deal with any issues that may arise, but I haven’t seen a serious issue in some time even though it’s a rolling release, cutting edge system. The forum for your flavor of Arch will keep you updated with any issues worth your attention when it comes to updating so you don’t end up with a broken system. So a Linux newbie could use it without issue contrary to Michael’s comments below.