Post

Yeah, it pays to also read over the changesets of any packaging updates since the last build. I still use an AUR helper, aurutils, but I also read over diffs for every package I update. Very important to pay attention to that, unfortunately. :/

how do you avoid getting infected

read the build script of an aur package before installing it carefully, so what ur supposed to do in the first place, this current one does bullshit with npm so if u see a random npm install in a build script even tho it shouldnt need npm at all thats a major red flag

heres a tester script u can use that checks if u have any of the currently known to have been hijacked packages installed gist.github.com/Kidev/59bf9f... heres also this thread that actively gets updated when new ones get found lists.archlinux.org/archives/lis...

what was it this time

someone sniping a bunch of orphaned aur packages to abuse some npm bullshit in the post install script to hijack people