TODO Hardening AUR builds: paru, devtools chroot, and what’s still not covered archlinuxsecurityaurdraft

Recently a malicious AUR package used a npm dependency (atomic-lockfile) to compromise systems. What was insidious about the attack was that it was more indirect than installing a simple backdoor: the PKGBUILD looked clean, instead the payload was in a transitive npm dependency.

That means it was very hard to detect (I certainly do not check all AUR dependencies) and it ran silently during the install phase. The incident was a good opportunity to have a closer look at my own setup.