Post #3300729

2026-06-12 12:21 UTC

But why would they care about supply chain attacks if they already have hacked into the package you’re requesting? In that case, executing python scripts would be less noticeable

Replies (1)

@lemmyvore@feddit.nl 2026-06-12 13:02

Here’s the AUR recipe (PKGBUILD file) for a random package: aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=na… This is a standard format for the recipe. It’s Bash code used to define variables and functions. You’ll notice there’s no place to sneak in a Python script. There is some brief Bash code in the functions but any major stuff would stand out immediately. So would an command that fetches a malware zip from a weird URL. Meanwhile, if you add node or python to the dependencies, and then run a command that installs a perfectly legit npm or pip module, nobody would bat an eye. It’s impossible to figure out that among the many upstream dependencies of that module there might be one that was subverted to discreetly run malware. AUR is a very bad idea tbh and should not be used by the faint of heart. It makes it entirely too easy to pull this kind of crap.

Open ##3300728