While this makes Arch Linux look bad right now, I recall how many years ago Gentoo was leading the pack with regards to having many clever people on board. Then came Arch Linux and eventually it put Gentoo as a second tier distribution. Arch has a lot of momentum; I myself am using Manjaro right now, primarily because it makes many things - including compiling from source - simple. As simple as Slackware, before Slackware fossilized (it's still alive of course, but just look at the most recent ISO release, then you'll understand the problem; when a distribution is no longer able to release .iso files, then it is in my book dead).
Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
41–50 of 227 posts
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#42I’m not on Arch Linux, but I am on NodeJS a lot, which frequently suffers from similar types of attacks. Who is doing package management right these days? Who is doing it securely?
Running external code will always be a risk. Even if it is not intended to be malicious it could still have issues that compromise security.
Read the source. If you don't have the time then you shouldn't run the software.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#43Could we be heading towards a world where it's just more secure to write inhouse software again, only now with AI agents? Not closed source per se, but 'own source'?
The endgame is to generate a binary image for an entire single-purpose OS/unikernel that does exactly and only what you require of it. No source to open or close.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#44Could we be heading towards a world where it's just more secure to write inhouse software again, only now with AI agents? Not closed source per se, but 'own source'?
Seems cheaper (and so far more robust) to have an agent audit downloaded code
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#45This is something that worries me with a distribution like Alpine Linux.
It is hard to avoid a package like chromium [0] or firefox which are in the "community" repo. Now have fun check it at every update, this is not practically feasible.
For the web browser one can say we should use Flatpak anyway but there are a lot of other apps like sway from the community repo that cannot be flatpaked.
- [0] https://pkgs.alpinelinux.org/package/edge/community/x86_64/c...
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#46> It was bad enough when finding out more than 400 AUR packages for Arch Linux users had been infected with malware but now that number has risen to around 900 a few hours ago and now in the end at more than 1,500 user-contributed packages.been infected with malware I never had a need for the AUR. If I want a package not in the official repository I build it myself or if it has a binary release I will download it. th…
[flagged]
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#47"linux has no malware, windows bad boooh"
"linux has a central package manager with every app that you need, so you don't need to install random apps from random websites like on windows"
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#48I’m not on Arch Linux, but I am on NodeJS a lot, which frequently suffers from similar types of attacks. Who is doing package management right these days? Who is doing it securely?
It's a lost battle.
Everything will need to be run in a VM separated from your main desktop which should have your data and a minimal amount of apps.
Qubes OS was ahead of it's time.
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#49Earlier quoted context omitted.
For me, this tradeoff isn’t worth it. I didn’t switch to Linux so that I can waste time going to websites and clicking “download” to update my programs like a Windows user. The pacman wrappers you mention are crazy, though.
I get it, but you only need to do that for the odd cases of packages not present in the official repo (not that common at all for me at least). Also if the software is downloaded in the form of a git repo, you only needed to checkout the new tag and rebuild, don't need your browser at all.
You then get the advantage of the OS’s package manager accounting for everything, however. It’s quite nice to not wonder whether there’s random stateful detritus throughout your system and what it might be affecting. (OK, to be honest there still will be, but much less of it, and a greater part of it will be attributable.)
Re: Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages
#50So from a quick read, it seems it installed "atomic-lockfile", "js-digest" or "lockfile-js" from npm. A list of affected packages is here [1]. Didn't find any quick info on how to check a system, so I ran the following command to find foreign packages and some date related infos: > pacman -Qmi Check the output against the list of affected packages. Then, you can also grep for those files in various locations: > grep…
The attacker used at least three Node dependencies in the attack, just checking for atomic-lockfile is not enough. The names js-digest and lockfile-js were also used, and at some point the attacker switched to bun instead of npm.