Ubuntu 'command-not-found' Tool Could Trick Users into Installing Rogue Packages

Aqua Security researchers disclosed that Ubuntu's default command-not-found utility can be manipulated via the snap ecosystem: attackers who claim snap names (including names matching APT packages) or register aliases/typosquatted snaps can have their malicious snaps suggested above legitimate APT packages, potentially leading users to install counterfeit software. The issue stems from command-not-found delegating snap suggestions to the advicesnap mechanism, and Aqua warns developers and users to register associated snap names and verify package sources to prevent impersonation and supply-chain abuse.