210
Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages
(www.phoronix.com)
this post was submitted on 13 Jun 2026
210 points (99.5% liked)
Technology
86159 readers
3265 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
PyPi has been an attack vector for a long time now. Just as with NPM, and others.
What makes you say that?
In Guix, package definitions are part of the Guix distro and are vetted.
(You can still add your own local package definitions, or pull a package definition of your schoolmates friend from their web site or Codeberg repo - Guix is very open in that sense. But, in the same way as with Ubuntu or Debian, you would have to add that package source explicitly. It is not the standard way of distributing packages. )
Also, Guix is rapidly growing (31,000 packages despite it is relatively young). I think the reason is that it both allows for cross-language projects (If you want to publish a vector drawing program with image algorithm libraries written in C, a GUI done in in Python, and memory-safe media importers written in Rust - it is made for that!). And it runs on top of many larger distributions (I use it on Debian stable and Arch).
Heard you the first time. I asked you what makes you think that's the case.
Guix is a smaller distro with (presumably) less maintainers, but it has 2x the packages that Arch has in it's official repos, and you assume they're well vetted? AUR has 3x (and a shitload of eyeballs), so it's probably a reasonable assumption as a comparison, but your post is basically just "trust me bro."
Guix packages are vetted.
AUR packages aren't.
And, package definitions in Guix are not shell scripts but highly abstracted functional installers that use the respective build tools of software packages. This makes them much easier to review - and quicker to write, in many cases.
Guix is also fully reproducible.
As the case of the xz-utils package shows, this does not prevent that a widely used project is taken over by malicious actors, and stealthily malware becomes inserted. But the effort to do this is much larger, since this needs write access to the software's source code.
And no, I don't think Guix is the magical silver bullet for software security. But it is much better than unvetted shell scripts in AUR.