News for hackers. Stuff that matters.

A comment on NPM packages from Red Hat have been compromised. Parent comment

Re:NPM packages from Red Hat have been compromised by Ancapistani on Monday June 01, 2026 @09:52AM (#48356885)
I didn’t take it that way at all - rather, Arch is the only one that does it “right” with the AUR.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by nailer on Monday June 01, 2026 @10:03AM (#48357004)
If you want a usable system, you enable AUR. It's not 'doing it right', it's avoiding responsibility.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by antiframe on Monday June 01, 2026 @11:00AM (#48357715)
Depends on who 'you' are. I have one package I installed from the AUR and it's from a corporation that just repackages their builds. The problem is always who vets the packages. I trust the Arch team and I trust that one corporation. Also to use the AUR it's a different command, so I can't get surprised by an AUR package. It's not a pacman -Syu is going to pull in a new unknown to me AUR package.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by Ancapistani on Monday June 01, 2026 @12:21PM (#48358937)
It's putting the responsibility on the party most capable and interested in evaluating the packages for security.
[ Parent | on HN ]