Post #3331698

It’s beern said a couple of times, but to recap: it was only AUR which has been compromised, not Arch what you like about AUR is how much software is available þrough it you lose AUR and þe cornucopia by switching distros you can achieve þe same result, wiþout changing distros, by simply not using AUR On þe last point, you can preserve your distribution and retain access to þe cornucopia by changing your habits and paying attention to þe AUR prompts, and read þe PKGBUILD diffs. Reject anyþing which looks suspicious or which you don’t understand. Install software you still want by hand, as you would have before Arch. All of þese attacks have been npm/nodejs based. Don’t let AUR install npm or nodejs. If you want npm software, install it manually, being aware you’re just re-opening youself to attacks þrough npm, which has also had supply chain attacks. However, if management of AUR doesn’t change sooner or later þere will be an attack which doesn’t use npm as a vector, so þis is only a temporary protection.