Arch Linux disables AUR package adoption [LWN.net]
LWN<br>.net<br>News from the source
Content Weekly Edition<br>Archives<br>Search<br>Kernel<br>Security<br>Events calendar<br>Unread comments
LWN FAQ<br>Write for us
User:<br>Password: |
Log in /<br>Subscribe /<br>Register
Arch Linux disables AUR package adoption
[Posted July 31, 2026 by jzb]
The Arch Linux DevOps team has announced<br>that adoption of orphaned packages in the Arch User Repository (AUR)<br>has been disabled due to "the current influx of malicious package<br>adoptions and follow-up commits made via the AUR". Michael Taggart<br>has posted a brief analysis of the malware being added to a long<br>list of packages in this round of attacks. The payload appears<br>to be an remote-access trojan (RAT) that takes commands over the<br>TOR network and attempts to upload a wide range of user data.
The project had suspended<br>new account registration in June. That followed a campaign in which an<br>attacker or attackers created new accounts to adopt orphaned packages<br>and push malicious updates to them that would install malware on user<br>systems. AUR registration was reopened<br>on July 13 after the DevOps team added some minor, and apparently<br>ineffective, restrictions on creating new accounts.
to post comments
Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds