The Arch User Repository is fighting off its third malware wave this year...
Started back in June — attackers were adopting orphaned/abandoned AUR packages (normal community feature, lets people pick up maintenance when someone disappears) and then quietly slipping malicious code into the PKGBUILD via follow-up commits. Over 1,900 compromised packages got purged. Arch devs called it clean by mid-June.
Then July 29 happens. New wave, kicked off through a package called openconnect-sso. Security researchers at IFIN dug into it and it's actually a pretty slick two-stage infection:
Stage 1: loader that checks for debuggers/sandboxes/VMs first (so it doesn't get caught by researchers), then sets up persistence via systemd services + cron jobs
Stage 2: pulls a Rust-based stealer+RAT from a Tor .onion server. Targets browser creds, crypto wallets, cloud secrets, AI API keys, and can worm laterally over stolen SSH keys
By July 30, over 200 packages were hit, including some fairly popular ones (boringssl-git, icloudpd).
That was enough for Arch to just disable AUR package adoption entirely — not the whole AUR, just the "take over an orphaned package" mechanism, since that's the attack vector.
The quote from the mailing list (Robin "Antiz" Candau, on behalf of Arch DevOps) is very much "we're tired":
"Due to the current influx of malicious package adoptions and follow-up commits made via the AUR, package adoption is currently disabled while we are handling the situation."
If you run Arch and use AUR helpers, now's a good time to actually read PKGBUILD diffs before you blindly update, especially for anything that recently changed maintainers.