Post by @hawthornbunny@equestria.social

2026-06-24 12:08 UTC

Currently having a fun little time checking my EndeavourOS system for packages that were compromised in the recent AUR malware attack. As far as I can tell, I&#39;ve avoided disaster - a scan found no compromised packages and I didn&#39;t update anything during the critical period. It has gotten me a bit more wary of the Arch User Repository (AUR), however. I&#39;ve always heard people say &quot;you can&#39;t trust anything in the AUR, it&#39;s a free-for-all&quot; - but, the pacman package manager doesn&#39;t treat it like a free-for-all. pacman lumps all the AUR stuff in with official packages with little distinction other than the AUR stuff has &quot;extra/&quot; at the start, and you can install those packages as easily as anything else. I think that&#39;s not pacman&#39;s fault - it&#39;s specifically designed to be that flexible, and it&#39;s doing exactly what it was told to do. I think the problem is more one of messaging and education - even with all the warnings, it never felt like using pacman was dangerous. #linux #pacman

Replies (1)

@Karcsesz@equestria.social 2026-06-25 06:51

@hawthornbunny@equestria.social You might be (understandably) conflating some things here. pacman has zero idea about the AUR on its own. Arch has three binary package sources grouped by how important the packages are: core (must-haves, like the kernel), extra (nice-to-haves, like desktop applications), and multilib for allowing a 32 bit programs on 64 bit kernels. Then there is the AUR that only provides glorified shell scripts that build a given package from source. Officially you have to git clone the script, run makepkg on it, then tell pacman to install the resulting package file. Now the part where it gets confusing: AUR helpers. Programs like pamac, paru, or yay take pacman's package management workflow and bolt on features that enable the user to install AUR packages (usually signified with AUR/pkgname) as if they were prebuilt packages. The helper grabs the script, builds, installs, and the only difference is you get a prompt to audit the script before building that you can too easily skip.

Open ##5299622