279
Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages
(www.phoronix.com)
this post was submitted on 13 Jun 2026
279 points (99.3% liked)
Technology
85672 readers
3551 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
PyPi has been an attack vector for a long time now. Just as with NPM, and others.
What makes you say that?
In Guix, package definitions are part of the Guix distro and are vetted.
(You can still add your own local package definitions, or pull a package definition of your schoolmates friend from their web site or Codeberg repo - Guix is very open in that sense. But, in the same way as with Ubuntu launchpad and ppa's or Debian third party repos, you would have to add that package source explicitly. It is not the standard way of distributing packages. )
Also, Guix is rapidly growing (31,000 packages despite it is relatively young). I think the reason is that it both allows for cross-language projects (If you want to publish a vector drawing program with image algorithm libraries written in C, a GUI done in in Python, and memory-safe media importers written in Rust - it is made for that!). And it runs on top of many larger distributions (I use it on Debian stable and Arch).
Heard you the first time. I asked you what makes you think that's the case.
Guix is a smaller distro with (presumably) less maintainers, but it has 2x the packages that Arch has in it's official repos, and you assume they're well vetted? AUR has 3x (and a shitload of eyeballs), so it's probably a reasonable assumption as a comparison, but your post is basically just "trust me bro."
Guix is not a small distro any more and has a lot of support. Yes it has more packages than Arch - but this is hardly an argument against it. It is built on different principles compared to the Arch user repository - keeping control of the own computer was always a core goal of GNU, and this logically includes security from malware.