Re:NPM packages from Red Hat have been compromised
by matheusmoreira on Monday June 01, 2026 @10:15AM
(#48357137)
I'm not tarring Arch, I was praising it. I made sure to explicitly spell out the "User Repository". Arch is the one that does it right.
Re:NPM packages from Red Hat have been compromised
by Ancapistani on Monday June 01, 2026 @09:52AM
(#48356885)
I didn’t take it that way at all - rather, Arch is the only one that does it “right” with the AUR.
Re:NPM packages from Red Hat have been compromised
by nailer on Monday June 01, 2026 @10:03AM
(#48357004)
If you want a usable system, you enable AUR. It's not 'doing it right', it's avoiding responsibility.
Re:NPM packages from Red Hat have been compromised
by antiframe on Monday June 01, 2026 @11:00AM
(#48357715)
Depends on who 'you' are. I have one package I installed from the AUR and it's from a corporation that just repackages their builds. The problem is always who vets the packages. I trust the Arch team and I trust that one corporation. Also to use the AUR it's a different command, so I can't get surprised by an AUR package. It's not a pacman -Syu is going to pull in a new unknown to me AUR package.
Re:NPM packages from Red Hat have been compromised
by Ancapistani on Monday June 01, 2026 @12:21PM
(#48358937)
It's putting the responsibility on the party most capable and interested in evaluating the packages for security.
Indeed, AUR is bad as a software distribution mechanism (really it's best understood as a proving ground for baby packages before they get real maintainers and distro blessing), but it's less bad than NPM which puts the malware in the trusted/default/automated path.