Post #3300443

2026-06-12 11:38 UTC

But if you look at some of the packages, they explicitly added npm as a new dependency. It’d be much easier to sneak in a python script.

Replies (1)

@lemmyvore@feddit.nl 2026-06-12 11:48

AUR “packages” are just a recipe file that runs some commands that sources packages from somewhere else and builds them then puts them in the format required by the AUR package manager. Normally it’s a source tarball downloaded directly from the project’s Git repo. But it can also fetch and install a binary package (for closed source software). Or it can install Node modules, or Python modules etc. Point is, you can’t inject a script directly in AUR itself. You could add the malicious code directly to the recipe file but it would be obvious. You could also download a zip with the malware directly, but it would also be obvious. So what they do is add the malware to modules published on another platform, and they’re downloaded indirectly, as a dependency of the Nth grade. It’s very hard to detect, you can’t really notice this kind of attack with a glance at the recipe.

Open ##3300504