Security News Arch Linux Disables AUR Package Takeovers as Attackers Push Malicious Commits

[Parkinsond]

Content source

https://cybersecuritynews.com/arch-linux-disables-aur-package/

Arch Linux has temporarily disabled package adoption on its Arch User Repository (AUR) after security teams detected a wave of malicious takeovers and follow-up commits designed to compromise unsuspecting users.

The move, announced by Robin Candau (known online as Antiz) on behalf of the Arch Linux DevOps team, comes as attackers increasingly exploit an abandoned or unmaintained package as an entry point for supply-chain attacks.

https://cybersecuritynews.com/arch-linux-disables-aur-package/

 

[lokamoka820]

With all due respect to Arch Linux users, I find it extremely difficult to trust AUR because anyone can upload any software they want to the repository.