On Thu, Jul 23, 2026 at 01:36:47AM +0200, [email protected] wrote: > I have a question regarding the AUR supply chain attack from June: Have all > known compromised packages been fixed and removed/updated from the AUR by now? > I'm uncertain whether it's safe to regularly run -Syu with my AUR helper > again. > I'm aware that AUR packages always carry some inherent security risk, but I > couldn't find a current overview of the situation online.
AFAIK, all compromised packages have been fixed, either by being removed or by deleting the malicious commits, and no new attacks have been detected. Needless to say, all usual AUR precautions still apply. (I'm just a regular Arch user, so take this with a grain of salt)
