Avoid this very common mistake
Transcript
Image of a man pointing a gun at his own foot. Caption: Installing an AUR package without reading it’s PKGBUILD.
log in to comment.
comments
‹ show full thread
· in reply to @MonkderVierte@lemmy.zip
Sorry I missed something, how so?
The compromised packages load a script from thr net that runs a compromised npm package (“atomic-lockfile” 1.4.2).
Ok, also a AUR issue. But more so a NPM one, since they have all full moon two supply-chain attacks.