>It seems there have been a few SBo updates pushed lately not by the >actual maintainers too (and maybe others that maintainers might have >even missed)... probably we need some GPG-style identity verification? > >On Fri, 12 Jun 2026, at 3:41 AM, jay wrote: >> Hi all, >> the Arch User Repository (AUR, basically Arch Linux' SBo) has been >> used as a malware (infostealer) vector today. >> >> I'm posting this to say we should be extra vigilant with the work of >> new maintainers taking over packages at this time. I propose the >> admins should ask the list if they're not sure about a submission or >> don't have the capacity to sufficiently check it. >> >> mode of operation: >> > The newest maintainer for the alvr AUR package has made a commit >> that >> adds npm packages to what is quite clearly not a npm project. As >> well as >> replaced the email addresses of previous maintainers with their own >> while keeping the same name as the latest committer. More can be >> seen from the comments of various users since this update has been >> pushed. >> –https://lists.archlinux.org/archives/list/[email protected]/thread/2LGBF2AZBPVCCY4VTN6DOVUNNBURFJ2J/ >> >> more info: >> https://lists.archlinux.org/archives/list/[email protected]/thread/FGXPCB3ZVCJIV7FX323SBAX2JHYB7ZS4/
Thanks for the info we are aware of such situation, but unless we force all maintainers to submit updates via github/gitlab, this kind of situation is easy to reproduce, since you just need to know maintainer's email in order to submit a new updates on behalf of the original maintainer. Another thing is that we do weekly updates, so everyone can review the current week's progress in https://slackbuilds.org/ready/ before it's merged. -- Willy Sudiarto Raharjo
pgpY4sZY5ZMXU.pgp
Description: OpenPGP digital signature
_______________________________________________ SlackBuilds-users mailing list [email protected] https://lists.slackbuilds.org/mailman/listinfo/slackbuilds-users Archives - https://lists.slackbuilds.org/pipermail/slackbuilds-users/ FAQ - https://slackbuilds.org/faq/
