Hacker News new | ask | show | jobs
by jorams 8 days ago
Packages in the AUR have some number of maintainers. When a maintainer no longer wants to maintain the package they can disown it, and when all maintainers do so the package becomes orphaned. An orphaned package can then be adopted by any user.

At any time there's a large number of orphaned packages in the AUR, and the attacker(s) targeted those.
2 comments
Slothrop99 8 days ago
Obviously way too easy to take over these 'orphaned' packages if it can be done in an automated manner. GitHub/NPM/etc doesn't have this issue, they need to stop equivicating. Sounds more like an anonymous FTP site.
link
mrbluecoat 8 days ago
This.

Who needs social engineering NPM maintainers when there are thousands of freebie AUR ones.

link