so there's no flash<br>of the wrong palette before React hydrates. Mirrors the useTheme hook<br>(storage key "rw-theme"; classes rw-theme-dark|light|ascii). -->

AUR malware wave forces Arch Linux to disable every package push - RuntimeWire

RuntimeWire

You're browsing RuntimeWire with JavaScript disabled. Articles and<br>navigation work fully. Interactive features — search, comments,<br>and newsletter signup — require JavaScript.

Why it matters

AUR recipes execute on developer machines that often hold source-control keys and cloud credentials. Attackers are turning trusted package ownership transfers into a distribution channel.

Arch Linux has disabled every push to the Arch User Repository, preventing maintainers from updating its community package recipes while the volunteer-run project removes malicious commits. The shutdown was amplified Sunday by International Cyber Digest, after Arch Linux DevOps contributor Robin Candau confirmed the freeze in the project's AUR mailing list.

"We have now disabled pushes altogether as well for the moment, while we handle the situation," Candau wrote on August 1st.

The move blocks new commits across the AUR, including legitimate package updates. Existing package recipes can still be read and downloaded, but maintainers cannot publish fixes or new versions through the normal Git workflow. The freeze does not affect packages distributed through Arch Linux's official repositories.

Candau, a Linux systems and DevOps engineer who joined the Arch staff in 2023, had already disabled package adoption on July 30th. He cited an influx of malicious adoptions and follow-up commits, and asked users to report suspicious activity. Less than two days later, the response escalated into a repository-wide write freeze.

A second containment failure

Arch Linux has been fighting malicious AUR activity since June. In a June 12th incident notice, package maintainer Campbell Jones said the project was seeing a high volume of malicious package adoptions and updates. The project warned that account creation, package updates, adoption and new package creation could be disrupted while maintainers traced harmful commits.

The project subsequently disabled new AUR registrations. On July 13th, DevOps contributor Leonidas Spyropoulos reopened registration with disposable email blocking, mandatory email verification and a cooldown on email changes.

Those account controls did not eliminate the larger weakness attackers were exploiting: AUR packages can retain their names and accumulated trust after an abandoned recipe changes hands.

Sonatype named the June campaign "Atomic Arch". Its researchers said attackers adopted orphaned packages and altered their PKGBUILD instructions to install malicious npm dependencies, including atomic-lockfile, js-digest and lockfile-js. Sonatype estimated that about 1,500 packages may have been affected across several waves, while cautioning that its analysis and package count were preliminary.

The payload Sonatype examined contained functionality associated with credential harvesting, anti-debugging, process and file hiding, and possible data exfiltration. Researchers found references to GitHub credentials, SSH artifacts, HashiCorp Vault tokens, browser cookies and data from workplace communication services. Sonatype advised treating machines that executed the payload as compromised because removing the AUR package alone may leave the second-stage malware in place.

Reports from the latest wave describe a different delivery method. In late July, AUR users flagged packages containing small ELF executables, sometimes named validator, assembler, optimizer or converter. Community members reported suspicious changes to packages including openconnect-sso, git-pkgs and nnn-nerd. Arch maintainers reverted commits and suspended accounts as reports arrived. The public evidence does not establish whether the late-July activity came from the operators behind Atomic Arch.

The AUR's trust handoff is the weak point

The AUR hosts user-submitted build recipes for software outside Arch Linux's official repositories. Those recipes are not vetted like official packages, and their scripts execute during the build or installation process. A malicious instruction can therefore reach a developer workstation even when the upstream software itself remains uncompromised.

Orphaned packages give attackers an efficient route into that workflow. An attacker can adopt a familiar package, preserve its recognizable name and history, and then change the instructions used by existing users during their next update. The package has already cleared the hardest distribution hurdle: persuading people to trust and install it.

Arch Linux continues to tell users to inspect every PKGBUILD and installation script change before updating AUR software. The all-push freeze shows the limits of relying on manual review once automated attackers can generate accounts, scan for abandoned packages and publish malicious...