Post #3316037
2026-06-14 12:13 UTC
That was my immediate reaction, too. And “why did I only find out on Lemmy!?”
It is hosted on archlinux.org after all.
…But to be fair, the AUR was always “use at your own risk.” It’s PKGBuilds are supposed to be manual scripts, not automated with yay/paru.
Its possible my downstream distro (CachyOS) sent some kind of alert through pacman or published some utility, but I am away from my desktop until tonight.
Replies (1)
-
@Tetsuo@jlai.lu 2026-06-14 12:25
How else would you have wanted to be warned ? In my opinion that’s the other side of the privacy coin. What happens on my system is only for me to check. And in that case that means I’m on my own to be aware of its current state. I mean the cachyos devs or the AUR maintainer have in some way by design no way to reach me. And creating some kind of malware monitoring or scanning tool included by default would be against the ethos of the OS… So it’s up to each user to determine if they want to use random scripts or just read the blog of their OS and do everything manually. There isn’t an adequate universal solution there.