A massive supply chain attack targeting the Arch User Repository (AUR) has compromised more than 400 community-maintained packages, with attackers injecting malicious build scripts designed to deploy credential-stealing malware and rootkit-style payloads on affected Linux systems.
I haven’t been on my PC that much this week, just Friday night. And our D&D group uses Discord so I needed to make sure it was up to date to ensure it would run. I typically just do a, “sudo pacman -Syu” and that seems to update what I need.
If that is the only thing I did with the PC during this window, is there any concern?
Nah, you’re fine the Discord package(https://archlinux.org/packages/extra/x86_64/discord/) is in the official repo and it was not affected at all. The only people who should worry are those using AUR helpers to install packages without checking the PKGBUILD
Probably not. The article says that most of it seems to have come from orphaned stuff in the AUR that the threat actors took ownership of via the legit process, then modified to pull down malicious NPM packages when someone went to install them.
So if your Discord package is well maintained you probably have nothing to worry about.