Avoid this very common mistake

@Malix@sopuli.xyz · @Malix@sopuli.xyz · 14 Aug 2026 · edited

as the other commenter said, but worth echoing:

is it suddenly using npm to install/run something? (iirc this was the attack vector for most packages that were infected)
suddenly added some weird extra wget/curl/whatever to packaging methods to fetch something weird?
are the package’s sources (eg. github urls) legit?

Generally you should be aware of who’se software you’re installing -> check if it’s downloading the stuff from right place, and nothing extra. The PKGBUILD changes in the aur website are pretty good indicator if something has changed and how.

edit: npm itself, or it’s usage isn’t bad - but it is quite suspicious if the AUR package isn’t for some webapp or so.

Avoid this very common mistake

comments