Hijacking Arch Linux Packages by Repo Jacking GitHub Repositories

Posted by joren485 on Monday April 10, 2023 @11:40AM
from the blog.nietaanraken.nl dept.

( 2 comments | on HN )

Re:Hijacking Arch Linux Packages by Repo Jacking GitHub Repo... by 2bluesc on Monday April 10, 2023 @01:48PM (#35515077)

Should note this only applies to AUR packages and `-git` mostly because of missing archive hashes.

AUR packages pinned to mutable tags are easiest to hijack.

[ Parent | on HN ]

Re:Hijacking Arch Linux Packages by Repo Jacking GitHub Repo... by _emacsomancer_ on Monday April 10, 2023 @02:51PM (#35515903)

article notes that they "found nine vulnerable packages (in the community repository)"

[ Parent | on HN ]