{"slug": "paru", "name": "paru", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 3, "commenters": 7, "warners": 0, "score": 3.708, "rising": -0.98, "first": "2026-02-10", "latest": "2026-06-22", "why": "paru presents all pkgbuild diffs to you before installing, that's what I use to read them.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 4, "compare": 0, "warn": 0}, "spark": [0, 0, 0, 2, 0, 0, 0, 1, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "paru presents all pkgbuild diffs to you before installing, that's what I use to read them.", "kind": "", "icon": true, "domain": null, "github_repo": "github.com/morganamilo/paru", "official_url": "https://github.com/Morganamilo/paru", "pricing": "", "aliases": ["paru", "Paru"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 776115728, "item_id": 48507233, "url": "https://news.ycombinator.com/item?id=48507233", "by": "streb-lo", "date": "2026-06-12", "stance": "recommend", "quote": "paru presents all pkgbuild diffs to you before installing, that's what I use to read them.", "excerpt": "paru presents all pkgbuild diffs to you before installing, that's what I use to read them. I usually only use AUR to install trusted pre-compiled binary packages, the scripts are very simple and the only thing that should ever change is the url and the sha256", "context": "Arch user", "use_case": "reviewing PKGBUILD diffs", "switched_from": "", "story": "AUR Packages Compromised with Infostealer and Rootkit"}, {"id": 751516276, "item_id": 46969767, "url": "https://news.ycombinator.com/item?id=46969767", "by": "wormius", "date": "2026-02-10", "stance": "recommend", "quote": "paru $PKG_NAME will give you a list of all possible packages", "excerpt": "I really don't want to be \"RTFM\" but and (mostly) apologize for the tone here, but I don't want this FUD to go without criticism. 1. There are actually TWO GUI package installers in Cachy. a. Cachy Package Manager (the one that you get from Hello) b. Octopi (as shown from their install instructions at their wiki, pasted below). https://wiki.cachyos.org/configuration/post_install_setup/ \"Octopi is a graphical package ", "context": "", "use_case": "AUR package management", "switched_from": "", "story": "The Switch to Linux and the Beginning of My Self-Hosting Journey"}, {"id": 751470656, "item_id": 46966916, "url": "https://news.ycombinator.com/item?id=46966916", "by": "alias_neo", "date": "2026-02-10", "stance": "recommend", "quote": "You can open a terminal and type `paru jetbrains-toolbox`, hit enter a couple of times and it's installed.", "excerpt": "You seem to have missed a couple of things that have caused you a bit of a headache here, I'm hoping I can encourage you to try again with a little bit of info. I've been using Linux for as long as it has existed, I'm also a backend-dev that works on a Linux machine and targets Linux-based platforms for deployment, even my kids use Linux. Windows went downhill for me after about Windows 2000 and Linux has only gotten", "context": "Linux user since the beginning, backend dev", "use_case": "AUR package installs", "switched_from": "", "story": "The Switch to Linux and the Beginning of My Self-Hosting Journey"}]}], "caveats": [], "who": [{"by": "streb-lo", "context": "Arch user", "url": "https://news.ycombinator.com/item?id=48507233", "date": "2026-06-12"}, {"by": "alias_neo", "context": "Linux user since the beginning, backend dev", "url": "https://news.ycombinator.com/item?id=46966916", "date": "2026-02-10"}], "tags": [], "use_cases": ["aur helper", "arch package management", "reviewing pkgbuild diffs", "aur package management", "aur package installs"], "compared": [{"slug": "yay", "name": "yay", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "cachyos", "name": "CachyOS", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "pacman", "name": "pacman", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48516379", "title": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=46964159", "title": "The Switch to Linux and the Beginning of My Self-Hosting Journey", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48586767", "title": "Package Managers need global hooks", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48500447", "title": "AUR Packages Compromised with Infostealer and Rootkit", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {"recommend": 2}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {"recommend": 1, "neutral": 4}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 778257601, "item_id": 48641100, "url": "https://news.ycombinator.com/item?id=48641100", "by": "captn3m0", "date": "2026-06-22", "stance": "neutral", "quote": "Yay and Paru both now support hooks", "excerpt": "(Author here). I don\u2019t really care _how and what you decide to do with it_, the post is about package managers giving users the ability to decide. Dependency Cooldowns can be implemented with global hooks, git-commit-signing checks can be implemented, LLM-scans can be implemented, someone can run the code in a jail and use the eBPF logs to publish a threat feed. Modern language packaging is also _source available_, a", "context": "", "use_case": "", "switched_from": "", "story": "Package Managers need global hooks"}, {"id": 776457794, "item_id": 48528612, "url": "https://news.ycombinator.com/item?id=48528612", "by": "aftbit", "date": "2026-06-14", "stance": "neutral", "quote": "I've used three in my career as an Arch user:", "excerpt": "I've used three in my career as an Arch user: yaourt yay paru https://github.com/Morganamilo/paru/issues/1563", "context": "", "use_case": "", "switched_from": "", "story": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages"}, {"id": 776344688, "item_id": 48521543, "url": "https://news.ycombinator.com/item?id=48521543", "by": "bilkow", "date": "2026-06-13", "stance": "neutral", "quote": "such as `paru`, which asks you to review the PKGBUILD diff", "excerpt": "Have you checked the install date? I'm not sure which are the compromised version numbers, but if they were installed before June 10 you're probably safe. (I think libgdata 0.18.1-5 used to be on the main repos in February, and has recently been downgraded to AUR, so you may be fine). Only packages from AUR have been compromised, meaning a normal update `pacman -Syu` won't install them, they'll only be installed by `", "context": "", "use_case": "AUR helper", "switched_from": "", "story": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages"}, {"id": 776316752, "item_id": 48519797, "url": "https://news.ycombinator.com/item?id=48519797", "by": "gpm", "date": "2026-06-13", "stance": "neutral", "quote": "The manager I use (paru) does", "excerpt": "The manager I use (paru) does, I'd be surprised if yay doesn't.", "context": "", "use_case": "Arch package management", "switched_from": "", "story": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages"}, {"id": 776115728, "item_id": 48507233, "url": "https://news.ycombinator.com/item?id=48507233", "by": "streb-lo", "date": "2026-06-12", "stance": "recommend", "quote": "paru presents all pkgbuild diffs to you before installing, that's what I use to read them.", "excerpt": "paru presents all pkgbuild diffs to you before installing, that's what I use to read them. I usually only use AUR to install trusted pre-compiled binary packages, the scripts are very simple and the only thing that should ever change is the url and the sha256", "context": "Arch user", "use_case": "reviewing PKGBUILD diffs", "switched_from": "", "story": "AUR Packages Compromised with Infostealer and Rootkit"}, {"id": 751516276, "item_id": 46969767, "url": "https://news.ycombinator.com/item?id=46969767", "by": "wormius", "date": "2026-02-10", "stance": "recommend", "quote": "paru $PKG_NAME will give you a list of all possible packages", "excerpt": "I really don't want to be \"RTFM\" but and (mostly) apologize for the tone here, but I don't want this FUD to go without criticism. 1. There are actually TWO GUI package installers in Cachy. a. Cachy Package Manager (the one that you get from Hello) b. Octopi (as shown from their install instructions at their wiki, pasted below). https://wiki.cachyos.org/configuration/post_install_setup/ \"Octopi is a graphical package ", "context": "", "use_case": "AUR package management", "switched_from": "", "story": "The Switch to Linux and the Beginning of My Self-Hosting Journey"}, {"id": 751470656, "item_id": 46966916, "url": "https://news.ycombinator.com/item?id=46966916", "by": "alias_neo", "date": "2026-02-10", "stance": "recommend", "quote": "You can open a terminal and type `paru jetbrains-toolbox`, hit enter a couple of times and it's installed.", "excerpt": "You seem to have missed a couple of things that have caused you a bit of a headache here, I'm hoping I can encourage you to try again with a little bit of info. I've been using Linux for as long as it has existed, I'm also a backend-dev that works on a Linux machine and targets Linux-based platforms for deployment, even my kids use Linux. Windows went downhill for me after about Windows 2000 and Linux has only gotten", "context": "Linux user since the beginning, backend dev", "use_case": "AUR package installs", "switched_from": "", "story": "The Switch to Linux and the Beginning of My Self-Hosting Journey"}]}