AUR malware wave forces Arch Linux to disable every package push
The volunteer-run project escalated from blocking package adoption to freezing the AUR write path after attackers abused trusted package workflows.
By Ryan Merket · Published
Primary source: International Cyber Digest on X
Why it matters
AUR recipes execute on developer machines that often hold source-control keys and cloud credentials. Attackers are turning trusted package ownership transfers into a distribution channel.
Arch Linux has disabled every push to the Arch User Repository, preventing maintainers from updating its community package recipes while the volunteer-run project removes malicious commits. The shutdown was amplified Sunday by International Cyber Digest, after Arch Linux DevOps contributor Robin Candau confirmed the freeze in the project's AUR mailing list.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.