Post #3300701
2026-06-12 12:57 UTC
To potentially prevent this entire class of npm attacks in the future, you could edit /etc/pacman.conf, uncomment
# Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
#IgnorePkg =
And set it to IgnorePkg = npm
Your system should prompt you to accept installing npm because it’s in the ignore list. These packages set it as a dependency, so that gives you a chance to notice that something’s off and refuse the install. This assumes you don’t already have npm installed or need it for some reason.
Replies (1)
-
@HaraldvonBlauzahn@feddit.org 2026-06-13 05:38
I want to call to your attention this article on by Marcus Ranum The six dumbest ideas in computer security and within it, the section #2 on “enumerating badness”. This is what you try here.