Post #3315942
2026-06-14 11:53 UTC
Not a dig at you or the script author, but I’m kinda miffed we’re relegated to running some rando github user’s bash scripts to check if we’re affected. This is the direct opposite response one should have to this kind of attack. I feel the AUR maintainers should have been more forthcoming about what they are doing to stop the attack and how users can mitigate the consequences if affected.
Replies (1)
-
@brucethemoose@lemmy.world 2026-06-14 12:13
That was my immediate reaction, too. And “why did I only find out on Lemmy!?” It is hosted on archlinux.org after all. …But to be fair, the AUR was always “use at your own risk.” It’s PKGBuilds are supposed to be manual scripts, not automated with yay/paru. Its possible my downstream distro (CachyOS) sent some kind of alert through pacman or published some utility, but I am away from my desktop until tonight.