Attackers infect nearly 900 Arch Linux User Repository packages with malware after posing as maintainers to adopt orphaned packages

This would never have been worth it when Arch was only used by “Arch people” (unemployed nerds)

Now that we’ve tricked normal people into using Arch, it is suddenly valuable as an attack surface

thought using arch would save me from cyberattacks because it's too obscure to be a valuable target

guess i thought wrong

@theo happened because there wasn't anything stoppping people from taking over orphaned packages and updating them with a little npm install (impressed this didnt happen before lol)

@theo Telling normies to run arch is stupid. AUR malware infestation has been a disaster bound to happen for years. On top of it, most Arch noob tutorials don’t even show someone how to configure AppArmor or SELinux. Unless you know what you’re doing or a company like Valve, just stop

@DanielleFong @NASA @IntCyberDigest Tu entras no tempo.. a cada segundo é um clone... Bem.. é tipo uma sombra viva.. de carne e osso... Eles é que torturam e fazem horrores sem fim a esses clones... Logo que ninguém os veja... @grok

KENNEDYS!!!!! @NASA

@KremlinRussia_E @MFA_China @mid_rf @Chinamission2un

@DanielleFong Escusam... não há apagão!

Kennedys! @nasa @IntCyberDigest

@theo NixOS solves this btw

@jetpackjoe_ No but some of his fans are

@theo Why u repost this racist account @theo ? Really expected better!

@theo The Microsoft paradox. Everyone starting to realize supporting real users is actually not easy.

@thoughtlesslabs @theo AUR are just build script handled by users, there is no support there.

@theo DHH is normal?

@theo it's not that normal people use arch, it's that blindly installing *aur* packages has become normalized using the default package repositories has been safe and is still safe, but the aur has always been just running unverified user scripts, and that's what this attack targeted

@theo the real security milestone is when the weird distro stops being a clubhouse and becomes someone’s unattended laptop fleet.

@theo now they're working on adding a human-review before people take over abandoned packages (thank god)

@theo ”Wait so anyone can publish packages on AUR how can it be secure?”

@theo Whole oss ecosystem is ran on trust, need some more organised effort to avoid this sort of things happening..

@theo Well that's what you get for following hype

Moral Lesson: If you are not in tech, Stay away for your own safety

@theo can confirm i stopped using arch when i became employed

@theo Its probably LLMs making it easier + cheaper to exploit Arch, rather than “normal” people flocking into it. I get the urge to feel special tho, hope you materialize it someday.