Tip to avoid malware from AUR: add node package managers to your IgnorePkg
Friendly reminder that given most of the ongoing attacks are based on node packages you can always add the package managers to your pacman.conf's IgnorePkg as a second line of defense (assuming you don't use them). IgnorePkg = yarn bun pnpm npm nodejs-nopt node-gyp And remember to check your PKGBUILDs! :) Fermín Olaiz. PS: sent this to arch-general as I think it might be useful.
On Thu, 2026-06-11 at 14:51 -0700, Fermín Olaiz wrote:
(assuming you don't use them).
IgnorePkg = yarn bun pnpm npm nodejs-nopt node-gyp
I use most of them. Do I understand correctly that... "npm install atomic-lockfile yargs" ...atomic-lockfile and yargs are bad? Can I check like this: # npm list -g --include=dev /usr/lib ├── acorn@8.16.0 ├── apaste@1.2.5 ├── bash-language-server@5.6.0 ├── node-gyp@12.4.0 ├── nopt@10.0.1 ├── npm@11.16.0 ├── semver@7.8.1 └── yarn@1.22.22 So everything is good? Or what do I need to test, to be sure that I'm not affected?
participants (2)
-
Fermín Olaiz
-
Ralf Mardorf